@ashlr/hub 2.2.0

package/dist/core/mcp-gateway.js

@@ -0,0 +1,385 @@
+/**
+ * core/mcp-gateway.ts — MCP aggregation gateway + per-server probe.
+ *
+ * Two responsibilities:
+ *
+ *   1. probeServer(spec, timeoutMs): start ONE downstream MCP server as a child,
+ *      list its tools, tear it down, and return an McpServerHealth. NEVER throws —
+ *      startup failures, timeouts, and crashes surface in the returned health
+ *      object (ok:false + error). Used by `ashlr mcp doctor` and gateway startup.
+ *
+ *   2. startGateway(registry): run a stdio MCP server (this process) that starts
+ *      every discovered downstream as a child, namespaces their tools as
+ *      `<server>__<tool>`, and proxies tools/list + tools/call to the correct
+ *      downstream. ROBUST: per-downstream startup timeout; a downstream that
+ *      fails to start is skipped with a stderr warning and never crashes the
+ *      gateway. Point ANY agent at `ashlr mcp` to get every discovered tool.
+ *
+ * This module is the ONLY place (besides mcp-registry) allowed to depend on
+ * @modelcontextprotocol/sdk.
+ */
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { loadConfig } from './config.js';
+import { withToolEnv } from './env-bridge.js';
+import { withHeal, defaultHealPolicy } from './run/self-heal.js';
+import { listNativeTools, isNativeTool, callNativeTool } from './mcp-native.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Default per-downstream startup/list timeout. */
+const DEFAULT_TIMEOUT_MS = 8_000;
+/** Namespacing separator: gateway tool name = `<server>__<tool>`. */
+const NS = '__';
+/**
+ * Env var set on every downstream child the gateway spawns. A downstream that
+ * is itself an ashlr gateway can read this to refuse re-aggregation, providing
+ * a second line of defense against the self-spawn fork bomb (the primary
+ * defense is isSelfGateway() filtering at startGateway).
+ */
+export const GATEWAY_ENV_MARKER = 'ASHLR_MCP_GATEWAY';
+// The MCP SDK deliberately spawns downstream servers with a NARROW env allowlist
+// (not the full process.env) so ambient secrets don't leak into third-party servers.
+// We preserve that isolation: downstreams get this safe base + ashlr's non-secret
+// config keys (via withToolEnv) + their own declared spec.env — never the hub's full env.
+const SAFE_CHILD_ENV_KEYS = ['HOME', 'PATH', 'SHELL', 'TERM', 'USER', 'LOGNAME'];
+function safeChildBase() {
+    const base = {};
+    for (const k of SAFE_CHILD_ENV_KEYS) {
+        if (process.env[k] !== undefined)
+            base[k] = process.env[k];
+    }
+    return base;
+}
+/**
+ * True when a spec resolves to THIS aggregation gateway — i.e. running it as a
+ * downstream would recurse (`ashlr mcp install` writes exactly such an entry:
+ * name "ashlr", command <bin>/ashlr, args ['mcp']). We detect it structurally
+ * (no path resolution needed): the canonical installed entry is `args`
+ * containing 'mcp' AND the command basename being `ashlr`, OR the conventional
+ * name 'ashlr' paired with an 'mcp' arg. Skipping these prevents an unbounded
+ * fan-out of nested gateways.
+ */
+export function isSelfGateway(spec) {
+    const hasMcpArg = spec.args.includes('mcp');
+    if (!hasMcpArg)
+        return false;
+    // basename of the command (handles absolute paths like /…/bin/ashlr)
+    const base = spec.command.split('/').pop() ?? spec.command;
+    return base === 'ashlr' || spec.name === 'ashlr';
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/** Reject after `ms` with a timeout error. */
+function timeout(ms, label) {
+    return new Promise((_resolve, reject) => {
+        const t = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+        // Don't keep the event loop alive solely for this timer.
+        if (typeof t.unref === 'function')
+            t.unref();
+    });
+}
+/**
+ * Build a connected SDK Client for one downstream spec, racing the connect
+ * against a timeout. The caller owns closing the returned client.
+ * Throws on failure (caller wraps).
+ */
+async function connectDownstream(spec, timeoutMs, cfg) {
+    const transport = new StdioClientTransport({
+        command: spec.command,
+        args: spec.args,
+        // Merge spec env with a self-marker so any downstream that happens to be an
+        // ashlr gateway can detect it was launched BY a gateway and refuse to
+        // re-aggregate (belt-and-suspenders against the self-spawn fork bomb).
+        // M10 env-bridge: project unified config into each downstream child, then
+        // let spec.env override (per-server keys win over hub-wide defaults).
+        // The gateway marker is set last so it can never be clobbered by spec.env.
+        env: {
+            ...(cfg ? withToolEnv(cfg, safeChildBase()) : safeChildBase()),
+            ...(spec.env ?? {}),
+            [GATEWAY_ENV_MARKER]: '1',
+        },
+        // Surface child stderr to our stderr for debugging; never pollutes stdio JSON-RPC.
+        stderr: 'inherit',
+    });
+    const client = new Client({ name: 'ashlr-gateway', version: '0.1.0' }, { capabilities: {} });
+    try {
+        // Capture the connect promise and pre-attach a no-op catch so that when the
+        // timeout branch wins the race, the still-pending connect's eventual
+        // rejection has a handler — otherwise it surfaces as an unhandledRejection
+        // (noisy on Node 22, fatal under --unhandled-rejections=throw).
+        const connectPromise = client.connect(transport);
+        connectPromise.catch(() => { });
+        await Promise.race([
+            connectPromise,
+            timeout(timeoutMs, `connect(${spec.name})`),
+        ]);
+    }
+    catch (err) {
+        // Ensure the child is reaped on a failed/timed-out connect.
+        try {
+            await client.close();
+        }
+        catch { /* ignore */ }
+        try {
+            await transport.close();
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+    return client;
+}
+// ---------------------------------------------------------------------------
+// probeServer
+// ---------------------------------------------------------------------------
+/**
+ * Start a single downstream MCP server, list its tools, and tear it down.
+ * NEVER throws — all failures (ENOENT, crash, timeout) are reported via the
+ * returned McpServerHealth (ok:false, toolCount:0, tools:[], error:<msg>).
+ *
+ * @param spec       The downstream server spec to probe.
+ * @param timeoutMs  Per-probe startup/list timeout (default 8s).
+ */
+export async function probeServer(spec, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    // M10: load config once so probeServer also bridges env into probed children.
+    // loadConfig() is lightweight (fs read + merge); safe to call per-probe.
+    let cfgForProbe;
+    try {
+        cfgForProbe = loadConfig();
+    }
+    catch { /* non-fatal: fall back to process.env */ }
+    let client = null;
+    try {
+        client = await connectDownstream(spec, timeoutMs, cfgForProbe);
+        const listed = await Promise.race([
+            client.listTools({}, { timeout: timeoutMs }),
+            timeout(timeoutMs, `tools/list(${spec.name})`),
+        ]);
+        const tools = (listed.tools ?? []).map((t) => t.name);
+        return {
+            name: spec.name,
+            ok: true,
+            toolCount: tools.length,
+            tools,
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            name: spec.name,
+            ok: false,
+            toolCount: 0,
+            tools: [],
+            error: msg,
+        };
+    }
+    finally {
+        if (client) {
+            try {
+                await client.close();
+            }
+            catch { /* ignore */ }
+        }
+    }
+}
+/**
+ * Run the aggregation gateway on stdio.
+ *
+ * Starts every server in `registry` as a child (skipping any that fail to start
+ * within the timeout, with a stderr warning), exposes their tools namespaced as
+ * `<server>__<tool>`, and proxies tools/list + tools/call to the owning
+ * downstream. Resolves only when the gateway transport closes (stdin EOF).
+ *
+ * @param registry   The discovered MCP servers to aggregate.
+ * @param timeoutMs  Per-downstream startup timeout (default 8s).
+ */
+export async function startGateway(registry, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    // M10: load config once for the gateway lifetime so all downstream spawns
+    // inherit the unified config env. Non-fatal if config is unreadable.
+    let gatewayCfg;
+    try {
+        gatewayCfg = loadConfig();
+    }
+    catch { /* non-fatal: fall back to process.env */ }
+    // ── Self-exclusion: never aggregate ourself (fork-bomb guard) ─────────────
+    // `ashlr mcp install` writes a downstream entry pointing back at this gateway.
+    // Discovering and spawning it would recurse without bound. Filter it out here
+    // (primary defense); the ASHLR_MCP_GATEWAY env marker on spawned children is
+    // the secondary defense for any path that bypasses this.
+    const aggregable = registry.servers.filter((spec) => {
+        if (isSelfGateway(spec)) {
+            process.stderr.write(`[ashlr mcp] skipping self "${spec.name}" (${spec.command} ${spec.args.join(' ')}) — would recurse\n`);
+            return false;
+        }
+        return true;
+    });
+    // ── Connect every downstream in parallel; skip failures ───────────────────
+    const settled = await Promise.allSettled(aggregable.map(async (spec) => {
+        // M20: bounded self-heal — restart a crashed downstream up to maxRestarts
+        // times before falling through to the existing skip-on-failure path.
+        // Opt-out: ASHLR_NO_HEAL env var disables the heal wrapper.
+        const noHeal = process.env['ASHLR_NO_HEAL'] === '1';
+        let client;
+        if (noHeal) {
+            client = await connectDownstream(spec, timeoutMs, gatewayCfg);
+        }
+        else {
+            const healPolicy = defaultHealPolicy();
+            client = await withHeal((_attempt) => connectDownstream(spec, timeoutMs, gatewayCfg), healPolicy, (event) => {
+                process.stderr.write(`[ashlr mcp] heal(${event.kind}) "${spec.name}" attempt ${event.attempt}: ${event.detail}\n`);
+            });
+        }
+        let toolNames = new Set();
+        try {
+            const listed = await Promise.race([
+                client.listTools({}, { timeout: timeoutMs }),
+                timeout(timeoutMs, `tools/list(${spec.name})`),
+            ]);
+            toolNames = new Set((listed.tools ?? []).map((t) => t.name));
+        }
+        catch (err) {
+            // Connected but couldn't list — close and rethrow so it's skipped.
+            try {
+                await client.close();
+            }
+            catch { /* ignore */ }
+            throw err;
+        }
+        return { spec, client, toolNames };
+    }));
+    const downstreams = [];
+    settled.forEach((result, i) => {
+        const name = aggregable[i]?.name ?? '(unknown)';
+        if (result.status === 'fulfilled') {
+            downstreams.push(result.value);
+            process.stderr.write(`[ashlr mcp] connected "${name}" (${result.value.toolNames.size} tools)\n`);
+        }
+        else {
+            const reason = result.reason instanceof Error ? result.reason.message : String(result.reason);
+            process.stderr.write(`[ashlr mcp] WARN skipping "${name}": ${reason}\n`);
+        }
+    });
+    const routes = new Map();
+    for (const d of downstreams) {
+        for (const toolName of d.toolNames) {
+            const key = `${d.spec.name}${NS}${toolName}`;
+            // M31 reserved-name guard (native wins; see tools/list for the live re-list guard).
+            if (isNativeTool(key)) {
+                process.stderr.write(`[ashlr mcp] WARN downstream "${key}" collides with a native ashlr tool — skipped\n`);
+                continue;
+            }
+            // Guard: a server name containing the NS separator can collide with a
+            // different (server, tool) pair, silently shadowing one route. Warn so the
+            // ambiguity is visible rather than last-writer-wins.
+            const prior = routes.get(key);
+            if (prior && prior.downstream.spec.name !== d.spec.name) {
+                process.stderr.write(`[ashlr mcp] WARN namespace collision on "${key}" ` +
+                    `("${prior.downstream.spec.name}" vs "${d.spec.name}") — last one wins\n`);
+            }
+            routes.set(key, { downstream: d, original: toolName });
+        }
+    }
+    // ── Build the gateway server ──────────────────────────────────────────────
+    const server = new Server({ name: 'ashlr', version: '0.1.0' }, { capabilities: { tools: {} } });
+    // tools/list — native ashlr tools first, then every downstream's, namespaced.
+    server.setRequestHandler(ListToolsRequestSchema, async () => {
+        const tools = [];
+        // M31: native tools are served by the gateway itself (ashlr_<verb> — single
+        // underscore; downstream keys always contain `__`, so collision is
+        // structurally impossible, but the route loop below still guards).
+        for (const t of listNativeTools()) {
+            tools.push({ name: t.name, description: t.description, inputSchema: t.inputSchema });
+        }
+        // Re-list live so the gateway reflects the current downstream tool set.
+        for (const d of downstreams) {
+            try {
+                const listed = await d.client.listTools({}, { timeout: timeoutMs });
+                for (const t of listed.tools ?? []) {
+                    const key = `${d.spec.name}${NS}${t.name}`;
+                    // M31 reserved-name guard: a downstream key can never shadow a native
+                    // tool (native wins; the collision is reported, not silently dropped).
+                    if (isNativeTool(key)) {
+                        process.stderr.write(`[ashlr mcp] WARN downstream "${key}" collides with a native ashlr tool — skipped\n`);
+                        continue;
+                    }
+                    tools.push({
+                        name: key,
+                        description: t.description
+                            ? `[${d.spec.name}] ${t.description}`
+                            : `[${d.spec.name}] ${t.name}`,
+                        inputSchema: t.inputSchema ?? { type: 'object' },
+                    });
+                    // Keep the route map fresh for tools/call.
+                    routes.set(key, { downstream: d, original: t.name });
+                }
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                process.stderr.write(`[ashlr mcp] WARN tools/list("${d.spec.name}") failed: ${msg}\n`);
+            }
+        }
+        // The SDK validates the result against ListToolsResultSchema.
+        return { tools };
+    });
+    // tools/call — native ashlr tools first, then proxy to the owning downstream.
+    server.setRequestHandler(CallToolRequestSchema, async (request) => {
+        const requested = request.params.name;
+        // M31: native tools route BEFORE the downstream map and never throw —
+        // failures come back as isError text results (audited in mcp-native).
+        if (isNativeTool(requested)) {
+            return callNativeTool(requested, request.params.arguments ?? {});
+        }
+        const route = routes.get(requested);
+        if (!route) {
+            throw new Error(`Unknown tool "${requested}". Expected an \`ashlr_*\` native tool or ` +
+                `"<server>${NS}<tool>" form. Run \`ashlr mcp list\` to see available tools.`);
+        }
+        const result = await route.downstream.client.callTool({
+            name: route.original,
+            arguments: request.params.arguments ?? {},
+        }, undefined, { timeout: timeoutMs });
+        return result;
+    });
+    // ── Graceful shutdown: close every downstream on exit ─────────────────────
+    // Runs exactly once even if multiple shutdown paths fire (stdin EOF +
+    // SIGTERM/SIGINT). Tracks downstreams via closure so signal handlers reach
+    // them and reap the spawned children rather than orphaning them.
+    let closed = false;
+    const closeAll = async () => {
+        if (closed)
+            return;
+        closed = true;
+        for (const d of downstreams) {
+            try {
+                await d.client.close();
+            }
+            catch { /* ignore */ }
+        }
+    };
+    // ── Serve on stdio ────────────────────────────────────────────────────────
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    process.stderr.write(`[ashlr mcp] gateway ready — ${listNativeTools().length} native ashlr tool(s) + ` +
+        `${routes.size} downstream tool(s) from ${downstreams.length}/${aggregable.length} server(s)\n`);
+    // Resolve when the transport closes (stdin EOF) OR a termination signal
+    // arrives — awaiting closeAll() in every path so children are torn down
+    // before we exit (the SDK's own child SIGTERM→SIGKILL teardown can take ~4s).
+    await new Promise((resolve) => {
+        const finish = () => { void closeAll().finally(() => resolve()); };
+        // stdin EOF (normal MCP client disconnect).
+        server.onclose = finish;
+        // Signal-based shutdown (common, normal termination path) — onclose does
+        // not necessarily fire, so handle SIGINT/SIGTERM explicitly.
+        const onSignal = (sig) => {
+            process.stderr.write(`[ashlr mcp] received ${sig} — shutting down\n`);
+            finish();
+        };
+        process.once('SIGINT', onSignal);
+        process.once('SIGTERM', onSignal);
+    });
+}
+//# sourceMappingURL=mcp-gateway.js.map

package/dist/core/mcp-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-gateway.js","sourceRoot":"","sources":["../../src/core/mcp-gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,qEAAqE;AACrE,MAAM,EAAE,GAAG,IAAI,CAAC;AAEhB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD,iFAAiF;AACjF,qFAAqF;AACrF,kFAAkF;AAClF,0FAA0F;AAC1F,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAC1F,SAAS,aAAa;IACpB,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,qEAAqE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC;IAC3D,OAAO,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;AACnD,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,8CAA8C;AAC9C,SAAS,OAAO,CAAI,EAAU,EAAE,KAAa;IAC3C,OAAO,IAAI,OAAO,CAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;QACzC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,yDAAyD;QACzD,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,UAAU;YAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAAC,IAAmB,EAAE,SAAiB,EAAE,GAAmC;IAC1G,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,4EAA4E;QAC5E,sEAAsE;QACtE,uEAAuE;QACvE,0EAA0E;QAC1E,sEAAsE;QACtE,2EAA2E;QAC3E,GAAG,EAAE;YACH,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;YACnB,CAAC,kBAAkB,CAAC,EAAE,GAAG;SAC1B;QACD,mFAAmF;QACnF,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,EAC3C,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;IAEF,IAAI,CAAC;QACH,4EAA4E;QAC5E,qEAAqE;QACrE,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,GAA2C,CAAC,CAAC,CAAC;QACxE,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,cAAc;YACd,OAAO,CAAO,SAAS,EAAE,WAAW,IAAI,CAAC,IAAI,GAAG,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4DAA4D;QAC5D,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC;YAAC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAmB,EACnB,YAAoB,kBAAkB;IAEtC,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,WAAsD,CAAC;IAC3D,IAAI,CAAC;QAAC,WAAW,GAAG,UAAU,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;IACvF,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC5C,OAAO,CAAgC,SAAS,EAAE,cAAc,IAAI,CAAC,IAAI,GAAG,CAAC;SAC9E,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,IAAI;YACR,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,KAAK;SACN,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,KAAK;YACT,SAAS,EAAE,CAAC;YACZ,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,GAAG;SACX,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAqB,EACrB,YAAoB,kBAAkB;IAEtC,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,UAAqD,CAAC;IAC1D,IAAI,CAAC;QAAC,UAAU,GAAG,UAAU,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;IAEtF,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,yDAAyD;IACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAClD,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CACtG,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAuB,EAAE;QACjD,0EAA0E;QAC1E,qEAAqE;QACrE,4DAA4D;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,GAAG,CAAC;QACpD,IAAI,MAAc,CAAC;QACnB,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;YACvC,MAAM,GAAG,MAAM,QAAQ,CACrB,CAAC,QAAQ,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,EAC5D,UAAU,EACV,CAAC,KAAgB,EAAE,EAAE;gBACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oBAAoB,KAAK,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,aAAa,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,IAAI,CAC7F,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;gBAC5C,OAAO,CAAgC,SAAS,EAAE,cAAc,IAAI,CAAC,IAAI,GAAG,CAAC;aAC9E,CAAC,CAAC;YACH,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrC,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,WAAW,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,WAAW,CAC3E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,IAAI,MAAM,MAAM,IAAI,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAIH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,KAAK,MAAM,QAAQ,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7C,oFAAoF;YACpF,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC,GAAG,iDAAiD,CACrF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,sEAAsE;YACtE,2EAA2E;YAC3E,qDAAqD;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4CAA4C,GAAG,IAAI;oBACnD,KAAK,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAC1E,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EACnC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,8EAA8E;IAC9E,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,KAAK,GAAmE,EAAE,CAAC;QACjF,4EAA4E;QAC5E,mEAAmE;QACnE,mEAAmE;QACnE,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,wEAAwE;QACxE,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACpE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;oBACnC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC3C,sEAAsE;oBACtE,uEAAuE;oBACvE,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;wBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gCAAgC,GAAG,iDAAiD,CACrF,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,GAAG;wBACT,WAAW,EAAE,CAAC,CAAC,WAAW;4BACxB,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE;4BACrC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE;wBAChC,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE;qBACjD,CAAC,CAAC;oBACH,2CAA2C;oBAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,IAAI,cAAc,GAAG,IAAI,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;QACD,8DAA8D;QAC9D,OAAO,EAAE,KAAK,EAA8E,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACtC,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,YAAY,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,OAAO,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,iBAAiB,SAAS,4CAA4C;gBACtE,YAAY,EAAE,8DAA8D,CAC7E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CACnD;YACE,IAAI,EAAE,KAAK,CAAC,QAAQ;YACpB,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE;SAC1C,EACD,SAAS,EACT,EAAE,OAAO,EAAE,SAAS,EAAE,CACvB,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,sEAAsE;IACtE,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QACzC,IAAI,MAAM;YAAE,OAAO;QACnB,MAAM,GAAG,IAAI,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC;gBAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IAEF,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,eAAe,EAAE,CAAC,MAAM,0BAA0B;QACjF,GAAG,MAAM,CAAC,IAAI,4BAA4B,WAAW,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,cAAc,CAChG,CAAC;IAEF,wEAAwE;IACxE,wEAAwE;IACxE,8EAA8E;IAC9E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,GAAS,EAAE,GAAG,KAAK,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzE,4CAA4C;QAC5C,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;QAExB,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,CAAC,GAAmB,EAAQ,EAAE;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,oBAAoB,CAAC,CAAC;YACtE,MAAM,EAAE,CAAC;QACX,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/mcp-native.d.ts

@@ -0,0 +1,53 @@
+/**
+ * M31: Native MCP tools — ashlr's own intelligence served by the gateway.
+ *
+ * SDK-FREE by contract: this module returns plain objects; mcp-gateway.ts is
+ * the only adapter (and, with mcp-registry, the only module allowed to import
+ * @modelcontextprotocol/sdk). Everything here is independently unit-testable
+ * without a transport.
+ *
+ * Safety model (CONTRACT-M31) — the gate is STRUCTURAL, enforced in
+ * callNativeTool before any handler runs:
+ *   'read'     — pure read of local stores; allowed even when KILL is on.
+ *   'append'   — append-only write under ~/.ashlr/ (genome hub); REFUSED on KILL.
+ *   'proposal' — creates a PENDING inbox Proposal; REFUSED on KILL.
+ *
+ * There is deliberately NO approve/reject/apply tool: approval stays human-only
+ * via `ashlr inbox`. `ashlr_ask` hardcodes allowCloud:false — agent sessions
+ * bring their own model; ashlr code never leaves the machine via this surface.
+ *
+ * Every call (ok / refused / error) is audited as 'mcp:native-call' with the
+ * tool name + argument KEYS only (never values). Output is secret-scrubbed and
+ * size-capped so a tool reply can never blow agent context or leak credentials.
+ */
+import type { NativeToolDef } from './types.js';
+/** The native tool definitions (no handlers) for diagnostics/docs surfaces. */
+export declare function nativeToolDefs(): NativeToolDef[];
+/** tools/list shape: name + description + inputSchema (gateway prepends these). */
+export declare function listNativeTools(): {
+    name: string;
+    description: string;
+    inputSchema: object;
+}[];
+/** True when `name` is a native tool (used by the gateway router). */
+export declare function isNativeTool(name: string): boolean;
+/**
+ * MCP-style text result (plain object; the SDK validates it gateway-side).
+ * A `type` alias (not an interface) so it picks up an implicit index signature
+ * and stays assignable to the SDK's CallToolResult without importing the SDK.
+ */
+export type NativeToolResult = {
+    content: {
+        type: 'text';
+        text: string;
+    }[];
+    isError?: boolean;
+};
+/** Exported for tests: serialize + scrub + cap exactly as tool results do. */
+export declare function renderToolText(payload: unknown): string;
+/**
+ * Execute a native tool through the full safety pipeline. NEVER throws:
+ * unknown tools, invalid args, kill-switch refusals, and handler failures all
+ * surface as isError text results. Every outcome is audited.
+ */
+export declare function callNativeTool(name: string, rawArgs: unknown): Promise<NativeToolResult>;