@algosuite/vo-mcp 0.2.0-beta.7 → 0.2.0-beta.71

package/dist/supervisor-credential-helper.js

@@ -0,0 +1,233 @@
+import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
+
+// src/cloud/credential-store.ts
+import { homedir } from "node:os";
+import { join, dirname } from "node:path";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+  chmodSync,
+  rmSync
+} from "node:fs";
+
+// src/cloud/keychain.ts
+import { createRequire } from "node:module";
+var SERVICE = "vo-mcp";
+var ACCOUNT = "refresh-credential";
+var cached;
+function loadKeyring() {
+  if (cached !== void 0) return cached;
+  try {
+    const req = createRequire(import.meta.url);
+    const mod = req("@napi-rs/keyring");
+    cached = mod && typeof mod.Entry === "function" ? mod : null;
+  } catch {
+    cached = null;
+  }
+  return cached;
+}
+function keychainAvailable() {
+  return loadKeyring() !== null;
+}
+function keychainGet() {
+  const k = loadKeyring();
+  if (!k) return null;
+  try {
+    return new k.Entry(SERVICE, ACCOUNT).getPassword();
+  } catch {
+    return null;
+  }
+}
+function keychainSet(secret) {
+  const k = loadKeyring();
+  if (!k) return false;
+  try {
+    new k.Entry(SERVICE, ACCOUNT).setPassword(secret);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function keychainDelete() {
+  const k = loadKeyring();
+  if (!k) return false;
+  try {
+    return new k.Entry(SERVICE, ACCOUNT).deletePassword();
+  } catch {
+    return false;
+  }
+}
+
+// src/cloud/credential-store.ts
+var realKeychain = {
+  available: keychainAvailable,
+  get: keychainGet,
+  set: keychainSet,
+  delete: keychainDelete
+};
+function credentialPath(env = process.env) {
+  const override = env["VO_MCP_CREDENTIALS_PATH"]?.trim();
+  if (override) return override;
+  return join(homedir(), ".config", "vo-mcp", "credentials.json");
+}
+function keychainEnabled(env, keychain) {
+  const disabled = (env["VO_MCP_DISABLE_KEYCHAIN"] ?? "").trim().toLowerCase();
+  if (disabled === "1" || disabled === "true" || disabled === "yes") return false;
+  return keychain.available();
+}
+function deserialize(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const refresh = typeof parsed.refresh_token === "string" ? parsed.refresh_token.trim() : "";
+    const apiKey = typeof parsed.api_key === "string" ? parsed.api_key.trim() : "";
+    const voCred = typeof parsed.vo_credential === "string" ? parsed.vo_credential.trim() : "";
+    if (!voCred && (!refresh || !apiKey)) return null;
+    return {
+      ...refresh ? { refresh_token: refresh } : {},
+      ...apiKey ? { api_key: apiKey } : {},
+      ...voCred ? { vo_credential: voCred } : {},
+      ...typeof parsed.vo_credential_expires_at === "string" ? { vo_credential_expires_at: parsed.vo_credential_expires_at } : {},
+      ...typeof parsed.email === "string" ? { email: parsed.email } : {},
+      ...typeof parsed.stored_at === "string" ? { stored_at: parsed.stored_at } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function readFromFile(env) {
+  try {
+    const p = credentialPath(env);
+    if (!existsSync(p)) return null;
+    return deserialize(readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function readStoredCredential(env = process.env, keychain = realKeychain) {
+  if (keychainEnabled(env, keychain)) {
+    const raw = keychain.get();
+    const fromKeychain = raw ? deserialize(raw) : null;
+    if (fromKeychain) return fromKeychain;
+  }
+  return readFromFile(env);
+}
+function readStoredCredentialKeychainOnly(env = process.env, keychain = realKeychain) {
+  if (!keychainEnabled(env, keychain)) return null;
+  const raw = keychain.get();
+  return raw ? deserialize(raw) : null;
+}
+
+// src/cloud/auth-token-source.ts
+var FIREBASE_SECURETOKEN_URL = "https://securetoken.googleapis.com/v1/token";
+var FIREBASE_TOKEN_REFERER = "https://algosuite.ai/";
+var REFRESH_SKEW_MS = 6e4;
+function createStaticTokenSource(token, kind = "admin-token") {
+  const value = token.trim();
+  return { kind, getToken: async () => value.length > 0 ? value : null };
+}
+function createFirebaseRefreshTokenSource(opts) {
+  const refreshToken = opts.refreshToken.trim();
+  const apiKey = opts.apiKey.trim();
+  const now = opts.now ?? (() => Date.now());
+  const fetchFn = opts.fetchFn ?? globalThis.fetch;
+  let cachedToken = null;
+  let expiresAtMs = 0;
+  let inFlight = null;
+  async function refresh() {
+    try {
+      const res = await fetchFn(`${FIREBASE_SECURETOKEN_URL}?key=${encodeURIComponent(apiKey)}`, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded",
+          referer: FIREBASE_TOKEN_REFERER
+        },
+        body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`
+      });
+      const text = await res.text();
+      if (res.status < 200 || res.status >= 300) {
+        cachedToken = null;
+        return null;
+      }
+      const parsed = JSON.parse(text);
+      const idToken = typeof parsed.id_token === "string" ? parsed.id_token : "";
+      if (!idToken) {
+        cachedToken = null;
+        return null;
+      }
+      const expiresInSec = Number(parsed.expires_in);
+      const ttlMs = Number.isFinite(expiresInSec) && expiresInSec > 0 ? expiresInSec * 1e3 : 36e5;
+      cachedToken = idToken;
+      expiresAtMs = now() + ttlMs;
+      return idToken;
+    } catch {
+      cachedToken = null;
+      return null;
+    }
+  }
+  return {
+    kind: "firebase-refresh",
+    async getToken() {
+      if (cachedToken && now() < expiresAtMs - REFRESH_SKEW_MS) return cachedToken;
+      if (!inFlight) {
+        inFlight = refresh().finally(() => {
+          inFlight = null;
+        });
+      }
+      return inFlight;
+    }
+  };
+}
+function createAuthTokenSourceFromEnv(env = process.env, fetchFn, readStoredCred = () => null) {
+  const refreshToken = env["VO_USER_REFRESH_TOKEN"]?.trim();
+  const apiKey = env["VO_FIREBASE_API_KEY"]?.trim();
+  const idToken = env["VO_USER_ID_TOKEN"]?.trim();
+  const adminToken = env["VO_CONTROL_PLANE_ADMIN_TOKEN"]?.trim();
+  if (refreshToken || apiKey) {
+    if (!refreshToken || !apiKey) {
+      throw new Error(
+        "Per-user refresh auth requires BOTH VO_USER_REFRESH_TOKEN and VO_FIREBASE_API_KEY"
+      );
+    }
+    return createFirebaseRefreshTokenSource({
+      refreshToken,
+      apiKey,
+      ...fetchFn ? { fetchFn } : {}
+    });
+  }
+  if (idToken) return createStaticTokenSource(idToken, "firebase-id-token");
+  const stored = readStoredCred();
+  if (stored?.vo_credential && stored.vo_credential.trim()) {
+    return createStaticTokenSource(stored.vo_credential.trim(), "vo-credential");
+  }
+  if (stored && stored.refresh_token?.trim() && stored.api_key?.trim()) {
+    return createFirebaseRefreshTokenSource({
+      refreshToken: stored.refresh_token.trim(),
+      apiKey: stored.api_key.trim(),
+      ...fetchFn ? { fetchFn } : {}
+    });
+  }
+  if (adminToken) return createStaticTokenSource(adminToken, "admin-token");
+  return null;
+}
+
+// src/supervisor-credential-helper.mjs
+var keychainOnly = process.argv.includes("--control-plane-auth-keychain-only");
+var credential = keychainOnly ? readStoredCredentialKeychainOnly() : readStoredCredential();
+if (process.argv.includes("--control-plane-auth") || keychainOnly) {
+  const source = createAuthTokenSourceFromEnv(process.env, void 0, () => credential);
+  const token = await source?.getToken();
+  if (!token) {
+    process.stderr.write("control-plane credential was not found\n");
+    process.exitCode = 2;
+  } else {
+    process.stdout.write(JSON.stringify({ token }));
+  }
+} else if (!credential) {
+  process.stderr.write("paired runner credential was not found\n");
+  process.exitCode = 2;
+} else {
+  process.stdout.write(JSON.stringify(credential));
+}
+//# sourceMappingURL=supervisor-credential-helper.js.map

package/dist/supervisor-credential-helper.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../src/cloud/credential-store.ts", "../src/cloud/keychain.ts", "../src/cloud/auth-token-source.ts", "../src/supervisor-credential-helper.mjs"],
+  "mappings": ";;;AAiCA,SAAS,eAAe;AACxB,SAAS,MAAM,eAAe;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACxBP,SAAS,qBAAqB;AAG9B,IAAM,UAAU;AAChB,IAAM,UAAU;AAYhB,IAAI;AAEJ,SAAS,cAAoC;AAC3C,MAAI,WAAW,OAAW,QAAO;AACjC,MAAI;AACF,UAAM,MAAM,cAAc,YAAY,GAAG;AACzC,UAAM,MAAM,IAAI,kBAAkB;AAClC,aAAS,OAAO,OAAO,IAAI,UAAU,aAAc,MAAwB;AAAA,EAC7E,QAAQ;AACN,aAAS;AAAA,EACX;AACA,SAAO;AACT;AAGO,SAAS,oBAA6B;AAC3C,SAAO,YAAY,MAAM;AAC3B;AAGO,SAAS,cAA6B;AAC3C,QAAM,IAAI,YAAY;AACtB,MAAI,CAAC,EAAG,QAAO;AACf,MAAI;AACF,WAAO,IAAI,EAAE,MAAM,SAAS,OAAO,EAAE,YAAY;AAAA,EACnD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,YAAY,QAAyB;AACnD,QAAM,IAAI,YAAY;AACtB,MAAI,CAAC,EAAG,QAAO;AACf,MAAI;AACF,QAAI,EAAE,MAAM,SAAS,OAAO,EAAE,YAAY,MAAM;AAChD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,iBAA0B;AACxC,QAAM,IAAI,YAAY;AACtB,MAAI,CAAC,EAAG,QAAO;AACf,MAAI;AACF,WAAO,IAAI,EAAE,MAAM,SAAS,OAAO,EAAE,eAAe;AAAA,EACtD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ADXA,IAAM,eAAgC;AAAA,EACpC,WAAW;AAAA,EACX,KAAK;AAAA,EACL,KAAK;AAAA,EACL,QAAQ;AACV;AAMO,SAAS,eAAe,MAAoD,QAAQ,KAAa;AACtG,QAAM,WAAW,IAAI,yBAAyB,GAAG,KAAK;AACtD,MAAI,SAAU,QAAO;AACrB,SAAO,KAAK,QAAQ,GAAG,WAAW,UAAU,kBAAkB;AAChE;AAMA,SAAS,gBACP,KACA,UACS;AACT,QAAM,YAAY,IAAI,yBAAyB,KAAK,IAAI,KAAK,EAAE,YAAY;AAC3E,MAAI,aAAa,OAAO,aAAa,UAAU,aAAa,MAAO,QAAO;AAC1E,SAAO,SAAS,UAAU;AAC5B;AAGA,SAAS,YAAY,KAAsC;AACzD,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAM,UAAU,OAAO,OAAO,kBAAkB,WAAW,OAAO,cAAc,KAAK,IAAI;AACzF,UAAM,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,QAAQ,KAAK,IAAI;AAC5E,UAAM,SAAS,OAAO,OAAO,kBAAkB,WAAW,OAAO,cAAc,KAAK,IAAI;AAExF,QAAI,CAAC,WAAW,CAAC,WAAW,CAAC,QAAS,QAAO;AAC7C,WAAO;AAAA,MACL,GAAI,UAAU,EAAE,eAAe,QAAQ,IAAI,CAAC;AAAA,MAC5C,GAAI,SAAS,EAAE,SAAS,OAAO,IAAI,CAAC;AAAA,MACpC,GAAI,SAAS,EAAE,eAAe,OAAO,IAAI,CAAC;AAAA,MAC1C,GAAI,OAAO,OAAO,6BAA6B,WAAW,EAAE,0BAA0B,OAAO,yBAAyB,IAAI,CAAC;AAAA,MAC3H,GAAI,OAAO,OAAO,UAAU,WAAW,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,MAClE,GAAI,OAAO,OAAO,cAAc,WAAW,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,IAChF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,KAA4E;AAChG,MAAI;AACF,UAAM,IAAI,eAAe,GAAG;AAC5B,QAAI,CAAC,WAAW,CAAC,EAAG,QAAO;AAC3B,WAAO,YAAY,aAAa,GAAG,MAAM,CAAC;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAQO,SAAS,qBACd,MAAoD,QAAQ,KAC5D,WAA4B,cACH;AACzB,MAAI,gBAAgB,KAAK,QAAQ,GAAG;AAClC,UAAM,MAAM,SAAS,IAAI;AACzB,UAAM,eAAe,MAAM,YAAY,GAAG,IAAI;AAC9C,QAAI,aAAc,QAAO;AAAA,EAC3B;AACA,SAAO,aAAa,GAAG;AACzB;AAGO,SAAS,iCACd,MAAoD,QAAQ,KAC5D,WAA4B,cACH;AACzB,MAAI,CAAC,gBAAgB,KAAK,QAAQ,EAAG,QAAO;AAC5C,QAAM,MAAM,SAAS,IAAI;AACzB,SAAO,MAAM,YAAY,GAAG,IAAI;AAClC;;;AEjIO,IAAM,2BAA2B;AAWjC,IAAM,yBAAyB;AAGtC,IAAM,kBAAkB;AAGjB,SAAS,wBACd,OACA,OAAgC,eACf;AACjB,QAAM,QAAQ,MAAM,KAAK;AACzB,SAAO,EAAE,MAAM,UAAU,YAAa,MAAM,SAAS,IAAI,QAAQ,KAAM;AACzE;AAiBO,SAAS,iCACd,MACiB;AACjB,QAAM,eAAe,KAAK,aAAa,KAAK;AAC5C,QAAM,SAAS,KAAK,OAAO,KAAK;AAChC,QAAM,MAAM,KAAK,QAAQ,MAAM,KAAK,IAAI;AACxC,QAAM,UAAqB,KAAK,WAAY,WAAW;AAEvD,MAAI,cAA6B;AACjC,MAAI,cAAc;AAElB,MAAI,WAA0C;AAE9C,iBAAe,UAAkC;AAC/C,QAAI;AACF,YAAM,MAAM,MAAM,QAAQ,GAAG,wBAAwB,QAAQ,mBAAmB,MAAM,CAAC,IAAI;AAAA,QACzF,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,SAAS;AAAA,QACX;AAAA,QACA,MAAM,0CAA0C,mBAAmB,YAAY,CAAC;AAAA,MAClF,CAAC;AACD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAI,IAAI,SAAS,OAAO,IAAI,UAAU,KAAK;AACzC,sBAAc;AACd,eAAO;AAAA,MACT;AACA,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,YAAM,UAAU,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AACxE,UAAI,CAAC,SAAS;AACZ,sBAAc;AACd,eAAO;AAAA,MACT;AACA,YAAM,eAAe,OAAO,OAAO,UAAU;AAC7C,YAAM,QAAQ,OAAO,SAAS,YAAY,KAAK,eAAe,IAAI,eAAe,MAAO;AACxF,oBAAc;AACd,oBAAc,IAAI,IAAI;AACtB,aAAO;AAAA,IACT,QAAQ;AACN,oBAAc;AACd,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,WAAmC;AACvC,UAAI,eAAe,IAAI,IAAI,cAAc,gBAAiB,QAAO;AACjE,UAAI,CAAC,UAAU;AACb,mBAAW,QAAQ,EAAE,QAAQ,MAAM;AACjC,qBAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAiBO,SAAS,6BACd,MAAoD,QAAQ,KAC5D,SAOA,iBAAuD,MAAM,MACrC;AACxB,QAAM,eAAe,IAAI,uBAAuB,GAAG,KAAK;AACxD,QAAM,SAAS,IAAI,qBAAqB,GAAG,KAAK;AAChD,QAAM,UAAU,IAAI,kBAAkB,GAAG,KAAK;AAC9C,QAAM,aAAa,IAAI,8BAA8B,GAAG,KAAK;AAG7D,MAAI,gBAAgB,QAAQ;AAC1B,QAAI,CAAC,gBAAgB,CAAC,QAAQ;AAC5B,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,iCAAiC;AAAA,MACtC;AAAA,MACA;AAAA,MACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/B,CAAC;AAAA,EACH;AAEA,MAAI,QAAS,QAAO,wBAAwB,SAAS,mBAAmB;AAExE,QAAM,SAAS,eAAe;AAI9B,MAAI,QAAQ,iBAAiB,OAAO,cAAc,KAAK,GAAG;AACxD,WAAO,wBAAwB,OAAO,cAAc,KAAK,GAAG,eAAe;AAAA,EAC7E;AAEA,MAAI,UAAU,OAAO,eAAe,KAAK,KAAK,OAAO,SAAS,KAAK,GAAG;AACpE,WAAO,iCAAiC;AAAA,MACtC,cAAc,OAAO,cAAc,KAAK;AAAA,MACxC,QAAQ,OAAO,QAAQ,KAAK;AAAA,MAC5B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/B,CAAC;AAAA,EACH;AAEA,MAAI,WAAY,QAAO,wBAAwB,YAAY,aAAa;AACxE,SAAO;AACT;;;AC/LA,IAAM,eAAe,QAAQ,KAAK,SAAS,oCAAoC;AAC/E,IAAM,aAAa,eAAe,iCAAiC,IAAI,qBAAqB;AAC5F,IAAI,QAAQ,KAAK,SAAS,sBAAsB,KAAK,cAAc;AACjE,QAAM,SAAS,6BAA6B,QAAQ,KAAK,QAAW,MAAM,UAAU;AACpF,QAAM,QAAQ,MAAM,QAAQ,SAAS;AACrC,MAAI,CAAC,OAAO;AACV,YAAQ,OAAO,MAAM,0CAA0C;AAC/D,YAAQ,WAAW;AAAA,EACrB,OAAO;AACL,YAAQ,OAAO,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC,CAAC;AAAA,EAChD;AACF,WAAW,CAAC,YAAY;AACtB,UAAQ,OAAO,MAAM,0CAA0C;AAC/D,UAAQ,WAAW;AACrB,OAAO;AACL,UAAQ,OAAO,MAAM,KAAK,UAAU,UAAU,CAAC;AACjD;",
+  "names": []
+}

package/dist/thresholds.json

@@ -0,0 +1,64 @@
+{
+  "version": "0.1.0",
+  "comment": "ADR-003 auto-router tunables. Calibration PRs edit THIS FILE (data, not code). rungBounds = minimum difficulty for each rung (R1 is everything below R2). bands = rung range the router may use per global dispatch mode; explicit task.tier is NEVER clamped.",
+  "rungBounds": { "R2": 25, "R3": 45, "R4": 65, "R5": 80 },
+  "bands": {
+    "fast": ["R1", "R2"],
+    "standard": ["R1", "R4"],
+    "deep": ["R2", "R5"],
+    "ultra": ["R3", "R5"],
+    "marathon": ["R4", "R5"],
+    "ultracode": ["R4", "R5"]
+  },
+  "bandsComment": "'ultracode' is the pre-2026-08-13 name for 'marathon'; kept so legacy task docs and stored configs still resolve a band.",
+  "rungs": {
+    "R1": { "tier": "cheap", "claudeEffort": "low",    "codexEffort": "low",    "maxTurns": 80,  "maxBudgetUsd": 1 },
+    "R2": { "tier": "cheap", "claudeEffort": "medium", "codexEffort": "medium", "maxTurns": 160, "maxBudgetUsd": 3 },
+    "R3": { "tier": "mid",   "claudeEffort": "high",   "codexEffort": "medium", "maxTurns": 240, "maxBudgetUsd": 10 },
+    "R4": { "tier": "best",  "claudeEffort": "high",   "codexEffort": "high",   "maxTurns": 400, "maxBudgetUsd": 25 },
+    "R5": { "tier": "best",  "claudeEffort": "xhigh",  "codexEffort": "xhigh",  "maxTurns": 800, "maxBudgetUsd": 50 }
+  },
+  "classBaseDifficulty": {
+    "chore": 15,
+    "docs": 20,
+    "test": 30,
+    "bugfix": 45,
+    "feature": 60,
+    "refactor": 60,
+    "research": 65,
+    "incident": 72,
+    "architecture": 80,
+    "general": 50
+  },
+  "modifiers": {
+    "evidenceRichBugfixDelta": -15,
+    "evidencePoorBugfixDelta": 20,
+    "scopeAmplifierDelta": 5,
+    "scopeAmplifierCap": 15,
+    "manyPathsDelta": 10,
+    "manyPathsThreshold": 3,
+    "veryManyPathsDelta": 15,
+    "veryManyPathsThreshold": 6,
+    "downMarkerDelta": -15,
+    "upMarkerDelta": 15,
+    "shortVaguePromptDelta": 10,
+    "shortVaguePromptMaxChars": 200,
+    "longPromptDelta": 5,
+    "longPromptMinChars": 4000,
+    "lowBudgetDelta": -10,
+    "lowBudgetMaxUsd": 2,
+    "roadmapPhaseDelta": 5,
+    "difficultyFloor": 5,
+    "difficultyCeiling": 100
+  },
+  "escapeHatch": { "minDifficulty": 65, "minCeilingRung": "R3" },
+  "operatorTierDefaultRung": { "cheap": "R2", "mid": "R3", "best": "R4" },
+  "shadowFanOut": {
+    "comment": "SHADOW-ONLY (never read by live routing). v0 fan-out gate inspired by the information-bottleneck framing of arXiv 2607.16133 — a conservative documented heuristic, NOT the paper's exact criterion. Fan-out is judged to add signal only when expected disagreement is high AND single-model confidence is low. Kept in sync with DEFAULT_SHADOW_FAN_OUT in role-cost-shadow.mjs (the in-code safe defaults when this key is absent).",
+    "minDisagreementSignal": 0.4,
+    "maxSingleModelConfidence": 0.6,
+    "minPanelSize": 2,
+    "defaultPanelSize": 3,
+    "neverFanOutClasses": ["chore", "docs"]
+  }
+}

package/dist/update-cli.js

@@ -2,8 +2,61 @@
 import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
 
 // src/update.ts
-import { spawnSync } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 import { createRequire } from "node:module";
+
+// ../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { win32 } from "node:path";
+var DEFAULT_RUNNER_PACKAGE = "@algosuite/vo-mcp@beta";
+var PACKAGE_SPEC_RE = /^@algosuite\/vo-mcp@(beta|latest|\d+(?:\.\d+){0,2}(?:-[\w.-]+)?)$/u;
+var NPM_CLI_SUFFIX = `\\${win32.join("node_modules", "npm", "bin", "npm-cli.js").toLowerCase()}`;
+function isNpmCliPath(value) {
+  return typeof value === "string" && win32.isAbsolute(value) && win32.normalize(value).toLowerCase().endsWith(NPM_CLI_SUFFIX);
+}
+function resolveNpmCli({
+  env = process.env,
+  execPath = process.execPath,
+  fileExists = existsSync
+} = {}) {
+  const candidates = [];
+  if (isNpmCliPath(env.npm_execpath)) candidates.push(env.npm_execpath);
+  candidates.push(win32.join(win32.dirname(execPath), "node_modules", "npm", "bin", "npm-cli.js"));
+  const pathValue = env.PATH ?? env.Path ?? env.path ?? "";
+  for (const entry of pathValue.split(";")) {
+    const trimmed = entry.trim();
+    if (!win32.isAbsolute(trimmed)) continue;
+    candidates.push(win32.join(trimmed, "node_modules", "npm", "bin", "npm-cli.js"));
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    const normalized = win32.normalize(candidate);
+    const key = normalized.toLowerCase();
+    if (seen.has(key) || !isNpmCliPath(normalized)) continue;
+    seen.add(key);
+    if (fileExists(normalized)) return normalized;
+  }
+  return null;
+}
+function buildMaintenanceCommand(kind, {
+  platform = process.platform,
+  packageSpec: packageSpec2 = DEFAULT_RUNNER_PACKAGE,
+  env = process.env,
+  execPath = process.execPath,
+  fileExists = existsSync
+} = {}) {
+  if (!["update", "reinstall"].includes(kind)) return null;
+  if (!PACKAGE_SPEC_RE.test(packageSpec2)) throw new Error("unsafe runner package spec");
+  const npmCli = platform === "win32" ? resolveNpmCli({ env, execPath, fileExists }) : null;
+  if (platform === "win32" && !npmCli) throw new Error("trusted npm CLI not found");
+  const command = platform === "win32" ? execPath : "npm";
+  const args = [...npmCli ? [npmCli] : [], "install", "-g", packageSpec2];
+  if (kind === "reinstall") args.push("--force");
+  return { command, args };
+}
+
+// src/update.ts
 var DEFAULT_UPDATE_SPEC = "@algosuite/vo-mcp@beta";
 function packageVersion() {
   try {
@@ -12,20 +65,29 @@ function packageVersion() {
     return "unknown";
   }
 }
-function npmCommand(platform) {
-  return platform === "win32" ? "npm.cmd" : "npm";
-}
-function buildUpdateCommand(packageSpec2 = DEFAULT_UPDATE_SPEC, platform = process.platform) {
-  return {
-    command: npmCommand(platform),
-    args: ["install", "-g", packageSpec2]
-  };
+function buildUpdateCommand(packageSpec2 = DEFAULT_UPDATE_SPEC, platform = process.platform, runtime = {}) {
+  const command = buildMaintenanceCommand("update", {
+    packageSpec: packageSpec2,
+    platform,
+    env: runtime.env,
+    execPath: runtime.execPath,
+    fileExists: runtime.fileExists
+  });
+  if (!command) throw new Error("update command unavailable");
+  return command;
 }
 function updateVoMcp(opts = {}) {
   const log = opts.log ?? ((message) => console.error(message));
   const platform = opts.platform ?? process.platform;
   const packageSpec2 = opts.packageSpec?.trim() || DEFAULT_UPDATE_SPEC;
-  const { command, args } = buildUpdateCommand(packageSpec2, platform);
+  let command;
+  let args;
+  try {
+    ({ command, args } = buildUpdateCommand(packageSpec2, platform, opts));
+  } catch (error) {
+    log(`Update unavailable: ${error instanceof Error ? error.message : String(error)}`);
+    return { ok: false, status: 2, command: "", args: [], skipped: false };
+  }
   log("=== vo-mcp updater ===");
   log(`Current installed package version: ${packageVersion()}`);
   log(`Updating MCP + runner with: ${command} ${args.join(" ")}`);
@@ -33,10 +95,11 @@ function updateVoMcp(opts = {}) {
     log("Dry run only - no package changes made.");
     return { ok: true, status: 0, command, args, skipped: true };
   }
-  const run = opts.spawn ?? spawnSync;
+  const run = opts.spawn ?? spawnSync2;
   const result2 = run(command, args, {
     stdio: "inherit",
-    shell: platform === "win32",
+    shell: false,
+    windowsHide: true,
     env: opts.env ?? process.env
   });
   const status = typeof result2.status === "number" ? result2.status : 1;

package/dist/update-cli.js.map

@@ -1,7 +1,6 @@
 {
   "version": 3,
-  "sources": ["../src/update.ts", "../src/update-cli.ts"],
-  "sourcesContent": ["/**\n * `vo-mcp update` - product-level updater for the MCP + runner package.\n *\n * Users should not have to uninstall/reinstall to pick up a new bundled runner.\n * The package is installed globally, so updating the single npm package updates\n * both `vo-mcp` and `vo-mcp runner` together.\n */\nimport { spawnSync } from 'node:child_process';\nimport { createRequire } from 'node:module';\n\nexport const DEFAULT_UPDATE_SPEC = '@algosuite/vo-mcp@beta';\n\nexport interface UpdateOptions {\n  readonly packageSpec?: string;\n  readonly dryRun?: boolean;\n  readonly log?: (message: string) => void;\n  readonly spawn?: typeof spawnSync;\n  readonly platform?: NodeJS.Platform;\n  readonly env?: NodeJS.ProcessEnv;\n}\n\nexport interface UpdateResult {\n  readonly ok: boolean;\n  readonly status: number;\n  readonly command: string;\n  readonly args: readonly string[];\n  readonly skipped: boolean;\n}\n\nfunction packageVersion(): string {\n  try {\n    return createRequire(import.meta.url)('../package.json').version || 'unknown';\n  } catch {\n    return 'unknown';\n  }\n}\n\nfunction npmCommand(platform: NodeJS.Platform): string {\n  return platform === 'win32' ? 'npm.cmd' : 'npm';\n}\n\nexport function buildUpdateCommand(\n  packageSpec = DEFAULT_UPDATE_SPEC,\n  platform: NodeJS.Platform = process.platform,\n): { command: string; args: string[] } {\n  return {\n    command: npmCommand(platform),\n    args: ['install', '-g', packageSpec],\n  };\n}\n\nexport function updateVoMcp(opts: UpdateOptions = {}): UpdateResult {\n  const log = opts.log ?? ((message: string) => console.error(message));\n  const platform = opts.platform ?? process.platform;\n  const packageSpec = opts.packageSpec?.trim() || DEFAULT_UPDATE_SPEC;\n  const { command, args } = buildUpdateCommand(packageSpec, platform);\n\n  log('=== vo-mcp updater ===');\n  log(`Current installed package version: ${packageVersion()}`);\n  log(`Updating MCP + runner with: ${command} ${args.join(' ')}`);\n\n  if (opts.dryRun) {\n    log('Dry run only - no package changes made.');\n    return { ok: true, status: 0, command, args, skipped: true };\n  }\n\n  const run = opts.spawn ?? spawnSync;\n  const result = run(command, args, {\n    stdio: 'inherit',\n    shell: platform === 'win32',\n    env: opts.env ?? process.env,\n  });\n  const status = typeof result.status === 'number' ? result.status : 1;\n  if (status !== 0) {\n    log(`Update failed with exit code ${status}.`);\n    return { ok: false, status, command, args, skipped: false };\n  }\n\n  log('\\nUpdate complete.');\n  log('Restart any running `vo-mcp runner` process so it loads the new bundle.');\n  log('If Claude Desktop / Claude Code was open, restart it to reload the MCP server.');\n  return { ok: true, status: 0, command, args, skipped: false };\n}\n", "#!/usr/bin/env node\n/**\n * `vo-mcp update` CLI entry point.\n */\nimport { updateVoMcp, DEFAULT_UPDATE_SPEC } from './update.js';\n\nfunction argValue(name: string): string | undefined {\n  const index = process.argv.indexOf(name);\n  return index >= 0 ? process.argv[index + 1] : undefined;\n}\n\nconst packageSpec = argValue('--package') || DEFAULT_UPDATE_SPEC;\nconst dryRun = process.argv.includes('--dry-run');\nconst result = updateVoMcp({ packageSpec, dryRun });\n\nprocess.exit(result.ok ? 0 : result.status || 1);\n"],
-  "mappings": ";;;;AAOA,SAAS,iBAAiB;AAC1B,SAAS,qBAAqB;AAEvB,IAAM,sBAAsB;AAmBnC,SAAS,iBAAyB;AAChC,MAAI;AACF,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,WAAW,UAAmC;AACrD,SAAO,aAAa,UAAU,YAAY;AAC5C;AAEO,SAAS,mBACdA,eAAc,qBACd,WAA4B,QAAQ,UACC;AACrC,SAAO;AAAA,IACL,SAAS,WAAW,QAAQ;AAAA,IAC5B,MAAM,CAAC,WAAW,MAAMA,YAAW;AAAA,EACrC;AACF;AAEO,SAAS,YAAY,OAAsB,CAAC,GAAiB;AAClE,QAAM,MAAM,KAAK,QAAQ,CAAC,YAAoB,QAAQ,MAAM,OAAO;AACnE,QAAM,WAAW,KAAK,YAAY,QAAQ;AAC1C,QAAMA,eAAc,KAAK,aAAa,KAAK,KAAK;AAChD,QAAM,EAAE,SAAS,KAAK,IAAI,mBAAmBA,cAAa,QAAQ;AAElE,MAAI,wBAAwB;AAC5B,MAAI,sCAAsC,eAAe,CAAC,EAAE;AAC5D,MAAI,+BAA+B,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE;AAE9D,MAAI,KAAK,QAAQ;AACf,QAAI,yCAAyC;AAC7C,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,SAAS,KAAK;AAAA,EAC7D;AAEA,QAAM,MAAM,KAAK,SAAS;AAC1B,QAAMC,UAAS,IAAI,SAAS,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,OAAO,aAAa;AAAA,IACpB,KAAK,KAAK,OAAO,QAAQ;AAAA,EAC3B,CAAC;AACD,QAAM,SAAS,OAAOA,QAAO,WAAW,WAAWA,QAAO,SAAS;AACnE,MAAI,WAAW,GAAG;AAChB,QAAI,gCAAgC,MAAM,GAAG;AAC7C,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,MAAM,SAAS,MAAM;AAAA,EAC5D;AAEA,MAAI,oBAAoB;AACxB,MAAI,yEAAyE;AAC7E,MAAI,gFAAgF;AACpF,SAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,SAAS,MAAM;AAC9D;;;AC5EA,SAAS,SAAS,MAAkC;AAClD,QAAM,QAAQ,QAAQ,KAAK,QAAQ,IAAI;AACvC,SAAO,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,IAAI;AAChD;AAEA,IAAM,cAAc,SAAS,WAAW,KAAK;AAC7C,IAAM,SAAS,QAAQ,KAAK,SAAS,WAAW;AAChD,IAAM,SAAS,YAAY,EAAE,aAAa,OAAO,CAAC;AAElD,QAAQ,KAAK,OAAO,KAAK,IAAI,OAAO,UAAU,CAAC;",
-  "names": ["packageSpec", "result"]
+  "sources": ["../src/update.ts", "../../../scripts/virtual-office/code-runner/runner-host-maintenance.mjs", "../src/update-cli.ts"],
+  "mappings": ";;;;AAOA,SAAS,aAAAA,kBAAiB;AAC1B,SAAS,qBAAqB;;;ACP9B,SAAS,iBAAiB;AAC1B,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AAEf,IAAM,yBAAyB;AACtC,IAAM,kBAAkB;AAExB,IAAM,iBAAiB,KAAK,MAAM,KAAK,gBAAgB,OAAO,OAAO,YAAY,EAAE,YAAY,CAAC;AAuBhG,SAAS,aAAa,OAAO;AAC3B,SAAO,OAAO,UAAU,YACnB,MAAM,WAAW,KAAK,KACtB,MAAM,UAAU,KAAK,EAAE,YAAY,EAAE,SAAS,cAAc;AACnE;AAUO,SAAS,cAAc;AAAA,EAC5B,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,QAAM,aAAa,CAAC;AACpB,MAAI,aAAa,IAAI,YAAY,EAAG,YAAW,KAAK,IAAI,YAAY;AACpE,aAAW,KAAK,MAAM,KAAK,MAAM,QAAQ,QAAQ,GAAG,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAE/F,QAAM,YAAY,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ;AACtD,aAAW,SAAS,UAAU,MAAM,GAAG,GAAG;AACxC,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,MAAM,WAAW,OAAO,EAAG;AAChC,eAAW,KAAK,MAAM,KAAK,SAAS,gBAAgB,OAAO,OAAO,YAAY,CAAC;AAAA,EACjF;AAEA,QAAM,OAAO,oBAAI,IAAI;AACrB,aAAW,aAAa,YAAY;AAClC,UAAM,aAAa,MAAM,UAAU,SAAS;AAC5C,UAAM,MAAM,WAAW,YAAY;AACnC,QAAI,KAAK,IAAI,GAAG,KAAK,CAAC,aAAa,UAAU,EAAG;AAChD,SAAK,IAAI,GAAG;AACZ,QAAI,WAAW,UAAU,EAAG,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,wBAAwB,MAAM;AAAA,EAC5C,WAAW,QAAQ;AAAA,EACnB,aAAAC,eAAc;AAAA,EACd,MAAM,QAAQ;AAAA,EACd,WAAW,QAAQ;AAAA,EACnB,aAAa;AACf,IAAI,CAAC,GAAG;AACN,MAAI,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,IAAI,EAAG,QAAO;AACpD,MAAI,CAAC,gBAAgB,KAAKA,YAAW,EAAG,OAAM,IAAI,MAAM,4BAA4B;AACpF,QAAM,SAAS,aAAa,UAAU,cAAc,EAAE,KAAK,UAAU,WAAW,CAAC,IAAI;AACrF,MAAI,aAAa,WAAW,CAAC,OAAQ,OAAM,IAAI,MAAM,2BAA2B;AAChF,QAAM,UAAU,aAAa,UAAU,WAAW;AAClD,QAAM,OAAO,CAAC,GAAI,SAAS,CAAC,MAAM,IAAI,CAAC,GAAI,WAAW,MAAMA,YAAW;AACvE,MAAI,SAAS,YAAa,MAAK,KAAK,SAAS;AAC7C,SAAO,EAAE,SAAS,KAAK;AACzB;;;AD5EO,IAAM,sBAAsB;AAqBnC,SAAS,iBAAyB;AAChC,MAAI;AACF,WAAO,cAAc,YAAY,GAAG,EAAE,iBAAiB,EAAE,WAAW;AAAA,EACtE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,mBACdC,eAAc,qBACd,WAA4B,QAAQ,UACpC,UAAkE,CAAC,GAC9B;AACrC,QAAM,UAAU,wBAAwB,UAAU;AAAA,IAChD,aAAAA;AAAA,IACA;AAAA,IACA,KAAK,QAAQ;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB,YAAY,QAAQ;AAAA,EACtB,CAAC;AACD,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,4BAA4B;AAC1D,SAAO;AACT;AAEO,SAAS,YAAY,OAAsB,CAAC,GAAiB;AAClE,QAAM,MAAM,KAAK,QAAQ,CAAC,YAAoB,QAAQ,MAAM,OAAO;AACnE,QAAM,WAAW,KAAK,YAAY,QAAQ;AAC1C,QAAMA,eAAc,KAAK,aAAa,KAAK,KAAK;AAChD,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,SAAS,KAAK,IAAI,mBAAmBA,cAAa,UAAU,IAAI;AAAA,EACrE,SAAS,OAAO;AACd,QAAI,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AACnF,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,SAAS,IAAI,MAAM,CAAC,GAAG,SAAS,MAAM;AAAA,EACvE;AAEA,MAAI,wBAAwB;AAC5B,MAAI,sCAAsC,eAAe,CAAC,EAAE;AAC5D,MAAI,+BAA+B,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC,EAAE;AAE9D,MAAI,KAAK,QAAQ;AACf,QAAI,yCAAyC;AAC7C,WAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,SAAS,KAAK;AAAA,EAC7D;AAEA,QAAM,MAAM,KAAK,SAASC;AAC1B,QAAMC,UAAS,IAAI,SAAS,MAAM;AAAA,IAChC,OAAO;AAAA,IACP,OAAO;AAAA,IACP,aAAa;AAAA,IACb,KAAK,KAAK,OAAO,QAAQ;AAAA,EAC3B,CAAC;AACD,QAAM,SAAS,OAAOA,QAAO,WAAW,WAAWA,QAAO,SAAS;AACnE,MAAI,WAAW,GAAG;AAChB,QAAI,gCAAgC,MAAM,GAAG;AAC7C,WAAO,EAAE,IAAI,OAAO,QAAQ,SAAS,MAAM,SAAS,MAAM;AAAA,EAC5D;AAEA,MAAI,oBAAoB;AACxB,MAAI,yEAAyE;AAC7E,MAAI,gFAAgF;AACpF,SAAO,EAAE,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,SAAS,MAAM;AAC9D;;;AEzFA,SAAS,SAAS,MAAkC;AAClD,QAAM,QAAQ,QAAQ,KAAK,QAAQ,IAAI;AACvC,SAAO,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,IAAI;AAChD;AAEA,IAAM,cAAc,SAAS,WAAW,KAAK;AAC7C,IAAM,SAAS,QAAQ,KAAK,SAAS,WAAW;AAChD,IAAM,SAAS,YAAY,EAAE,aAAa,OAAO,CAAC;AAElD,QAAQ,KAAK,OAAO,KAAK,IAAI,OAAO,UAAU,CAAC;",
+  "names": ["spawnSync", "packageSpec", "packageSpec", "spawnSync", "result"]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@algosuite/vo-mcp",
-  "version": "0.2.0-beta.7",
-  "description": "Virtual Office MCP server — open protocol surface for the VO consensus / ratchet tool family. Stdio transport, cross-vendor MCP client compatible (Claude Code, Claude Desktop, Cursor, Continue).",
+  "version": "0.2.0-beta.71",
+  "description": "AlgoHQ MCP server — open protocol surface for the HQ consensus and ratchet tool family. Stdio transport, cross-vendor MCP client compatible (Claude Code, Claude Desktop, Codex, Cursor, Continue).",
   "license": "Apache-2.0",
   "type": "module",
   "main": "dist/index.js",
@@ -22,7 +22,7 @@
     }
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "zod": "^4.4.3"
   },
   "optionalDependencies": {
@@ -34,11 +34,13 @@
   "keywords": [
     "mcp",
     "model-context-protocol",
+    "algohq",
     "virtual-office",
     "consensus",
     "ratchet",
     "claude",
     "claude-desktop",
+    "codex",
     "cursor",
     "continue"
   ],