@atolis-hq/wake 0.4.48 → 0.4.50

package/dist/src/execution/infrastructure/workspace/git-workspace.js

@@ -1,6 +1,6 @@
 /* eslint-disable max-lines */
 import { execFile } from 'node:child_process';
-import { access, mkdir, readdir, readFile, realpath, rm, writeFile } from 'node:fs/promises';
+import { access, mkdir, readdir, readFile, realpath, rename, rm, rmdir, unlink, writeFile, } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { promisify } from 'node:util';
 import { isActiveRunStatus, RunStatus, WorkspaceMode } from '../../contracts/vocabulary.js';
@@ -9,18 +9,21 @@ const exec = promisify(execFile);
 export class GitWorkspaceProvider {
     root;
     resolver;
+    locks;
     git;
     prepareHook;
     markerRoot;
     recoveryFileSystem;
-    constructor(root, resolver, git = async (arguments_, signal) => {
-        await exec('git', arguments_, { signal });
+    pendingReleases = new Map();
+    constructor(root, resolver, locks, git = async (arguments_, signal) => {
+        return (await exec('git', arguments_, { signal })).stdout.trim();
     }, recoveryFileSystem = {
         remove: async (path) => rm(path, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 }),
         canonicalize: realpath,
     }, prepareHook) {
         this.root = root;
         this.resolver = resolver;
+        this.locks = locks;
         this.git = git;
         this.prepareHook = prepareHook;
         this.markerRoot = join(this.root, '.wake-workspace-ownership');
@@ -34,59 +37,161 @@ export class GitWorkspaceProvider {
         const name = `${request.workItemId}-${request.mode}-${slug(locator)}`;
         const path = resolve(this.root, name);
         const markerPath = join(this.markerRoot, `${name}.json`);
+        const lockPath = join(this.markerRoot, `${name}.lease`);
         await mkdir(dirname(markerPath), { recursive: true });
+        const scope = await recoveryScope(this.root, this.markerRoot);
+        if (scope === null)
+            throw new Error('Workspace ownership directory is outside the managed root');
+        await validateLeasePaths(scope, lockPath);
+        const lock = await acquireWorkspaceLock(this.locks, lockPath, signal);
+        try {
+            const branch = await this.prepareCheckout(request, locator, name, path, markerPath);
+            if (this.prepareHook !== undefined)
+                await prepareWorkspace(path, this.prepareHook, signal);
+            signal.throwIfAborted();
+            let released = false;
+            return {
+                workspaceId: name,
+                path,
+                mode: request.mode,
+                ...(branch === undefined ? {} : { branch }),
+                release: async () => {
+                    if (released)
+                        return;
+                    await this.releaseWorkspaceLock(lockPath, lock);
+                    released = true;
+                },
+            };
+        }
+        catch (error) {
+            await this.releaseWorkspaceLock(lockPath, lock);
+            throw error;
+        }
+    }
+    async releaseWorkspaceLock(path, lock) {
+        try {
+            await lock.release();
+            if (this.pendingReleases.get(path) === lock)
+                this.pendingReleases.delete(path);
+        }
+        catch (error) {
+            this.pendingReleases.set(path, lock);
+            throw error;
+        }
+    }
+    async prepareCheckout(request, locator, name, path, markerPath) {
+        const { signal } = request;
+        const previousMarker = await readMarker(markerPath);
+        if (await exists(join(this.markerRoot, `${name}.lock`), signal))
+            throw new Error('Legacy workspace lock requires recovery before acquisition');
+        let initialRevision = previousMarker?.initialRevision;
+        let checkoutReady;
         signal.throwIfAborted();
-        await writeFile(markerPath, JSON.stringify({
+        const writeMarker = () => writeOwnershipMarker(markerPath, {
             runId: request.runId,
             workItemId: request.workItemId,
             repositoryResourceId: request.repositoryResource.resourceId,
             mode: request.mode,
             workspaceId: name,
             path,
-        }), { encoding: 'utf8', signal });
-        const existingWorkspace = await exists(join(path, '.git'), signal);
+            checkoutReady,
+            ...(initialRevision === undefined ? {} : { initialRevision }),
+        }, signal);
+        const existingWorkspace = await this.reuseCheckout(previousMarker, markerPath, path, request.mode, signal);
+        checkoutReady = previousMarker?.checkoutReady ?? existingWorkspace;
+        if (!existingWorkspace) {
+            initialRevision = undefined;
+            checkoutReady = false;
+        }
+        await writeMarker();
         if (!existingWorkspace) {
             await mkdir(dirname(path), { recursive: true });
             signal.throwIfAborted();
             await this.git(['clone', locator, path], signal);
         }
+        if (initialRevision === undefined)
+            initialRevision = await readCheckoutRevision(path, this.git, signal);
         const branch = request.mode === WorkspaceMode.Branch ? request.workItemId : undefined;
-        if (branch !== undefined)
+        if (branch !== undefined) {
             await this.git(['-C', path, 'switch', ...(existingWorkspace ? [] : ['--create']), branch], signal);
-        if (this.prepareHook !== undefined)
-            await prepareWorkspace(path, this.prepareHook, signal);
-        signal.throwIfAborted();
-        return {
-            workspaceId: name,
-            path,
-            mode: request.mode,
-            ...(branch === undefined ? {} : { branch }),
-            release: async () => {
-                if (request.mode !== WorkspaceMode.ReadOnly)
-                    return;
-                await rm(path, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
-                await rm(markerPath, { force: true });
-            },
-        };
+        }
+        checkoutReady = true;
+        await writeMarker();
+        if (branch === undefined) {
+            await restoreReadOnlyWorkspace(path, request.checkoutRevision, initialRevision, this.git, signal);
+        }
+        return branch;
+    }
+    async reuseCheckout(marker, markerPath, path, mode, signal) {
+        if (!(await exists(path, signal)))
+            return false;
+        const scope = await recoveryScope(this.root, this.markerRoot);
+        if (scope === null ||
+            marker === null ||
+            !(await isOwnedWorkspace(scope, markerPath, marker, this.recoveryFileSystem)) ||
+            !(await canRemoveOwnedWorkspace(scope, path)))
+            throw new Error('Cannot acquire an unvalidated existing workspace');
+        if (marker.checkoutReady === false) {
+            await this.recoveryFileSystem.remove(path);
+            return false;
+        }
+        if (!(await exists(join(path, '.git'), signal))) {
+            if (mode === WorkspaceMode.Branch)
+                throw new Error('Cannot reuse a branch checkout without Git metadata');
+            await this.recoveryFileSystem.remove(path);
+            return false;
+        }
+        return this.validateLegacyCheckout(marker, path, mode, signal);
+    }
+    async validateLegacyCheckout(marker, path, mode, signal) {
+        if (marker.checkoutReady !== undefined || mode !== WorkspaceMode.ReadOnly)
+            return true;
+        try {
+            await readCheckoutRevision(path, this.git, signal);
+            return true;
+        }
+        catch {
+            signal.throwIfAborted();
+            // Legacy read-only clones may predate the durable completion flag.
+            await this.recoveryFileSystem.remove(path);
+            return false;
+        }
     }
     async recover(runs, options = {}) {
         const scope = await recoveryScope(this.root, this.markerRoot);
         if (scope === null)
             return emptyRecovery();
-        const markers = await recoveryMarkerNames(this.markerRoot);
+        const releaseFailures = [];
+        for (const [path, lock] of this.pendingReleases) {
+            if (await options.isPaused?.())
+                break;
+            try {
+                await this.releaseWorkspaceLock(path, lock);
+            }
+            catch (error) {
+                releaseFailures.push({ markerPath: path, path, message: errorMessage(error) });
+            }
+        }
+        const names = await recoveryMarkerNames(this.markerRoot);
+        const workspaceIds = new Set(names.flatMap((name) => {
+            const match = /^(.*)\.(?:json(?:\.pending)?|lock|lease(?:\.owners)?)$/.exec(name);
+            return match !== null && isSafeWorkspaceId(match[1]) ? [match[1]] : [];
+        }));
         let reclaimed = 0;
         const reclaimedWorkItemIds = [];
-        const failures = [];
-        for (const filename of markers) {
+        const failures = [...releaseFailures];
+        for (const workspaceId of workspaceIds) {
             if (await options.isPaused?.())
                 break;
-            const result = await recoverMarker({
-                filename,
+            const result = await recoverWorkspace({
+                workspaceId,
                 markerRoot: this.markerRoot,
                 scope,
                 runs,
                 fileSystem: this.recoveryFileSystem,
                 options,
+                locks: this.locks,
+                releaseLock: (path, lock) => this.releaseWorkspaceLock(path, lock),
             });
             reclaimed += result.reclaimed;
             reclaimedWorkItemIds.push(...(result.reclaimedWorkItemIds ?? []));
@@ -113,13 +218,40 @@ async function recoveryMarkerNames(markerRoot) {
         return [];
     }
 }
-async function recoverMarker(input) {
-    if (!input.filename.endsWith('.json'))
-        return emptyRecovery();
-    const markerPath = join(input.markerRoot, input.filename);
-    const marker = await readMarker(markerPath);
+async function validateLeasePaths(scope, path) {
+    for (const target of [
+        path,
+        `${path}.owners`,
+        `${path.slice(0, -'.lease'.length)}.lock`,
+        `${path.slice(0, -'.lease'.length)}.json.pending`,
+    ]) {
+        const canonical = await canonicalPath(target);
+        if (canonical !== null && canonical !== join(scope.markerRoot, basename(target)))
+            throw new Error('Workspace lease artifacts must not be symbolic links');
+    }
+}
+async function recoverWorkspace(input) {
+    const markerPath = join(input.markerRoot, `${input.workspaceId}.json`);
+    let marker = null;
     try {
-        return await reclaimOwnedMarker(input, markerPath, marker);
+        const lockPath = join(input.markerRoot, `${input.workspaceId}.lease`);
+        await validateLeasePaths(input.scope, lockPath);
+        const lock = await input.locks.tryAcquire(lockPath);
+        if (!lock.acquired)
+            return emptyRecovery();
+        try {
+            if (!(await recoverLegacyLock(join(input.markerRoot, `${input.workspaceId}.lock`), input.runs)))
+                return emptyRecovery();
+            await rm(`${markerPath}.pending`, { force: true });
+            marker = await readMarker(markerPath);
+            if (marker === null ||
+                !(await isOwnedWorkspace(input.scope, markerPath, marker, input.fileSystem)))
+                return emptyRecovery();
+            return await reclaimUnlockedMarker(input, markerPath, marker);
+        }
+        finally {
+            await input.releaseLock(lockPath, lock);
+        }
     }
     catch (error) {
         return {
@@ -128,10 +260,35 @@ async function recoverMarker(input) {
         };
     }
 }
-async function reclaimOwnedMarker(input, markerPath, marker) {
-    if (marker === null ||
-        !(await isOwnedWorkspace(input.scope, markerPath, marker, input.fileSystem)))
-        return emptyRecovery();
+// Migration only: new acquisitions never create directory locks.
+async function recoverLegacyLock(path, runs) {
+    if ((await canonicalPath(path)) === null)
+        return true;
+    const owner = await readLockOwner(path);
+    if (owner === undefined)
+        return false;
+    if (owner === null && runs.some(protectsWorkspace))
+        return false;
+    if (owner !== null && runs.some((run) => run.runId === owner && protectsWorkspace(run)))
+        return false;
+    if (owner !== null)
+        await unlink(join(path, owner));
+    try {
+        await rmdir(path);
+        return true;
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return true;
+        if (isNotEmpty(error))
+            return false;
+        throw error;
+    }
+}
+function protectsWorkspace(run) {
+    return isActiveRunStatus(run.status) || run.status === RunStatus.Ambiguous;
+}
+async function reclaimUnlockedMarker(input, markerPath, marker) {
     if (input.runs.some((run) => (isActiveRunStatus(run.status) || run.status === RunStatus.Ambiguous) &&
         (run.runId === marker.runId || run.workspace?.path === marker.path)))
         return emptyRecovery();
@@ -143,6 +300,7 @@ async function reclaimOwnedMarker(input, markerPath, marker) {
         await input.fileSystem.remove(marker.path);
     if ((await input.options.onWorkspaceReclaimed?.(marker.workItemId)) === false)
         return emptyRecovery();
+    await rm(`${markerPath}.pending`, { force: true });
     await rm(markerPath, { force: true });
     return {
         reclaimed: 1,
@@ -182,7 +340,12 @@ function isOwnershipMarker(value) {
         typeof marker.repositoryResourceId === 'string' &&
         (marker.mode === WorkspaceMode.ReadOnly || marker.mode === WorkspaceMode.Branch) &&
         typeof marker.workspaceId === 'string' &&
-        typeof marker.path === 'string');
+        typeof marker.path === 'string' &&
+        hasValidCheckoutState(marker));
+}
+function hasValidCheckoutState(marker) {
+    return ((marker.initialRevision === undefined || typeof marker.initialRevision === 'string') &&
+        (marker.checkoutReady === undefined || typeof marker.checkoutReady === 'boolean'));
 }
 async function isOwnedWorkspace(scope, markerPath, marker, fileSystem) {
     if (!isSafeWorkspaceId(marker.workspaceId))
@@ -248,6 +411,75 @@ async function exists(path, signal) {
         return false;
     }
 }
+async function restoreReadOnlyWorkspace(path, revision, initialRevision, git, signal) {
+    if (revision !== undefined) {
+        await git(['-C', path, 'fetch', 'origin', revision], signal);
+        const fetched = await readGitRevision(path, 'FETCH_HEAD^{commit}', git, signal);
+        await git(['-C', path, 'checkout', '--detach', '--force', fetched], signal);
+        await git(['-C', path, 'reset', '--hard', fetched], signal);
+        return;
+    }
+    await git(['-C', path, 'reset', '--hard', initialRevision], signal);
+}
+async function readCheckoutRevision(path, git, signal) {
+    return readGitRevision(path, 'HEAD^{commit}', git, signal);
+}
+async function readGitRevision(path, reference, git, signal) {
+    const revision = await git(['-C', path, 'rev-parse', '--verify', reference], signal);
+    if (typeof revision !== 'string' || revision.trim() === '')
+        throw new Error('Git runner did not attest a valid workspace HEAD');
+    return revision.trim();
+}
+async function writeOwnershipMarker(path, marker, signal) {
+    const pending = `${path}.pending`;
+    try {
+        await writeFile(pending, JSON.stringify(marker), { encoding: 'utf8', signal });
+        signal.throwIfAborted();
+        await rename(pending, path);
+    }
+    finally {
+        await rm(pending, { force: true });
+    }
+}
+async function acquireWorkspaceLock(locks, path, signal) {
+    while (true) {
+        signal.throwIfAborted();
+        const lock = await locks.tryAcquire(path);
+        if (lock.acquired)
+            return lock;
+        await waitForLock(signal);
+    }
+}
+async function readLockOwner(path) {
+    try {
+        const owners = await readdir(path);
+        if (owners.length === 0)
+            return null;
+        return owners.length === 1 ? owners[0] : undefined;
+    }
+    catch (error) {
+        if (isNotFound(error))
+            return null;
+        throw error;
+    }
+}
+function isNotEmpty(error) {
+    return (typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOTEMPTY');
+}
+function waitForLock(signal) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(done, 25);
+        const abort = () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        };
+        function done() {
+            signal.removeEventListener('abort', abort);
+            resolve();
+        }
+        signal.addEventListener('abort', abort, { once: true });
+    });
+}
 function slug(value) {
     return value
         .toLowerCase()

package/dist/src/surfaces/api/contracts/work.d.ts

@@ -35,6 +35,16 @@ export interface WorkDetailResponse {
     readonly activities: {
         readonly pullRequest?: PullRequestResponse;
     };
+    readonly artifacts: readonly {
+        readonly revisionId: string;
+        readonly producer: string;
+        readonly path: string;
+        readonly occurredAt: string;
+        readonly mediaType?: string;
+        readonly byteLength?: number;
+        readonly digest?: string;
+        readonly href: string;
+    }[];
     readonly conversation: {
         /** Whether this authenticated surface may create control-plane entries. */
         readonly canCreateEntries: boolean;

package/dist/src/surfaces/api/routes/applications.d.ts

@@ -56,6 +56,11 @@ export interface ApiApplications {
         list(query: CollectionQuery): Promise<ApiCollectionPage<WorkItemResponse>>;
         detail(key: string): Promise<ApiResourceResult<WorkDetailResponse> | undefined>;
         transcript?(key: string, groupId: string): Promise<ApiResourceResult<WorkItemTranscriptResponse> | undefined>;
+        artifact?(key: string, revisionId: string): Promise<{
+            readonly bytes: Uint8Array;
+            readonly mediaType: string;
+            readonly filename: string;
+        } | undefined>;
         freeze?(key: string, command: ApiCommandRequest): Promise<ApiCommandResult>;
         unfreeze?(key: string, command: ApiCommandRequest): Promise<ApiCommandResult>;
         delete?(key: string, command: ApiCommandRequest): Promise<ApiCommandResult>;

package/dist/src/surfaces/api/routes/read.js

@@ -108,9 +108,9 @@ async function collectionResult(applications, pathname, query) {
     }
 }
 async function readDetail(applications, pathname) {
-    const workTranscript = /^\/api\/v1\/work-items\/([^/]+)\/transcripts\/([^/]+)$/.exec(pathname);
-    if (workTranscript?.[1] !== undefined && workTranscript[2] !== undefined)
-        return readWorkTranscript(applications, workTranscript[1], workTranscript[2]);
+    const workSubresource = await readWorkSubresource(applications, pathname);
+    if (workSubresource !== undefined)
+        return workSubresource;
     const transcript = /^\/api\/v1\/runs\/([^/]+)\/transcript$/.exec(pathname)?.[1];
     if (transcript !== undefined)
         return readTranscript(applications, transcript);
@@ -120,6 +120,37 @@ async function readDetail(applications, pathname) {
     const run = /^\/api\/v1\/runs\/([^/]+)$/.exec(pathname)?.[1];
     return run === undefined ? undefined : readRun(applications, run);
 }
+async function readWorkSubresource(applications, pathname) {
+    const workTranscript = /^\/api\/v1\/work-items\/([^/]+)\/transcripts\/([^/]+)$/.exec(pathname);
+    if (workTranscript?.[1] !== undefined && workTranscript[2] !== undefined)
+        return readWorkTranscript(applications, workTranscript[1], workTranscript[2]);
+    const artifact = /^\/api\/v1\/work-items\/([^/]+)\/artifacts\/([^/]+)$/.exec(pathname);
+    if (artifact?.[1] !== undefined && artifact[2] !== undefined)
+        return readWorkArtifact(applications, artifact[1], artifact[2]);
+    return undefined;
+}
+async function readWorkArtifact(applications, keySegment, revisionSegment) {
+    const key = decodePathSegment(keySegment);
+    const revisionId = decodePathSegment(revisionSegment);
+    if (key instanceof ApiPathError)
+        return invalidPath(key.message);
+    if (revisionId instanceof ApiPathError)
+        return invalidPath(revisionId.message);
+    if (applications.work.artifact === undefined)
+        return unavailable('artifact');
+    const artifact = await applications.work.artifact(key, revisionId);
+    if (artifact === undefined)
+        return found(undefined);
+    return {
+        status: 200,
+        body: artifact.bytes,
+        contentType: artifact.mediaType,
+        headers: {
+            'content-disposition': `attachment; filename*=UTF-8''${encodeURIComponent(artifact.filename)}`,
+            'content-length': String(artifact.bytes.byteLength),
+        },
+    };
+}
 async function readWorkTranscript(applications, keySegment, groupSegment) {
     const key = decodePathSegment(keySegment);
     const groupId = decodePathSegment(groupSegment);

package/dist/src/surfaces/api/routes/work.d.ts

@@ -1 +1 @@
-export declare const workRoutes: readonly ["/api/v1/work-items", "/api/v1/work-items/:workItemKey", "/api/v1/work-items/:workItemKey/transcripts/:groupId", "/api/v1/work-items/:workItemKey/commands/freeze", "/api/v1/work-items/:workItemKey/commands/unfreeze", "/api/v1/work-items/:workItemKey/commands/delete", "/api/v1/work-items/:workItemKey/commands/retry", "/api/v1/work-items/:workItemKey/commands/extend", "/api/v1/work-items/:workItemKey/commands/message"];
+export declare const workRoutes: readonly ["/api/v1/work-items", "/api/v1/work-items/:workItemKey", "/api/v1/work-items/:workItemKey/transcripts/:groupId", "/api/v1/work-items/:workItemKey/artifacts/:revisionId", "/api/v1/work-items/:workItemKey/commands/freeze", "/api/v1/work-items/:workItemKey/commands/unfreeze", "/api/v1/work-items/:workItemKey/commands/delete", "/api/v1/work-items/:workItemKey/commands/retry", "/api/v1/work-items/:workItemKey/commands/extend", "/api/v1/work-items/:workItemKey/commands/message"];

package/dist/src/surfaces/api/routes/work.js

@@ -2,6 +2,7 @@ export const workRoutes = [
     '/api/v1/work-items',
     '/api/v1/work-items/:workItemKey',
     '/api/v1/work-items/:workItemKey/transcripts/:groupId',
+    '/api/v1/work-items/:workItemKey/artifacts/:revisionId',
     '/api/v1/work-items/:workItemKey/commands/freeze',
     '/api/v1/work-items/:workItemKey/commands/unfreeze',
     '/api/v1/work-items/:workItemKey/commands/delete',

package/dist/src/surfaces/cli/main.d.ts

@@ -15,6 +15,11 @@ export type WakeCommand = ({
 }) | ({
     readonly kind: 'api' | 'ui';
 } & HostOptions) | ({
+    readonly kind: 'mcp';
+} & {
+    readonly sessionPath: string;
+    readonly wakeRoot?: string;
+}) | ({
     readonly kind: 'ui-token';
     readonly accessKey?: string;
 } & Pick<HostOptions, 'wakeRoot'>) | {
@@ -84,6 +89,9 @@ export interface WakeCliApplications {
     readonly ui: {
         start(options?: HostOptions): Promise<void>;
     };
+    readonly mcp?: {
+        serve(sessionPath: string, token: string): Promise<void>;
+    };
     readonly auth?: {
         token(accessKey?: string): Promise<string>;
     };

package/dist/src/surfaces/cli/main.js

@@ -27,6 +27,8 @@ export function parseWakeCommand(arguments_) {
             return parseUiCommand(arguments_.slice(1));
         case 'api':
             return { kind: command, ...parseHostOptions(arguments_.slice(1)) };
+        case 'mcp':
+            return parseMcpCommand(arguments_.slice(1));
         case 'tick':
         case 'start':
         case 'stop':
@@ -44,6 +46,27 @@ export function parseWakeCommand(arguments_) {
             throw new Error(`Unknown wake command: ${command ?? ''}`);
     }
 }
+function parseMcpCommand(arguments_) {
+    if (arguments_[0] !== 'serve')
+        throw new Error(`Unknown mcp command: ${arguments_[0] ?? ''}`);
+    let sessionPath;
+    let wakeRoot;
+    for (let index = 1; index < arguments_.length; index += 2) {
+        const flag = arguments_[index];
+        const value = requiredArgument(arguments_[index + 1], `value for ${flag ?? 'option'}`);
+        if (flag === '--session' && sessionPath === undefined)
+            sessionPath = value;
+        else if (flag === '--wake-root' && wakeRoot === undefined)
+            wakeRoot = value;
+        else
+            throw new Error(`Unknown or duplicate mcp option: ${flag ?? ''}`);
+    }
+    return {
+        kind: 'mcp',
+        sessionPath: requiredArgument(sessionPath, 'mcp --session'),
+        ...(wakeRoot === undefined ? {} : { wakeRoot }),
+    };
+}
 function parseUiCommand(arguments_) {
     if (arguments_[0] !== 'token')
         return { kind: 'ui', ...parseHostOptions(arguments_) };
@@ -194,6 +217,9 @@ export async function runWakeCommand(command, applications, output, signal) {
         case 'ui-token':
             output.write(await formatUiTokenOutput(auth(applications).token(command.accessKey)));
             return;
+        case 'mcp':
+            await mcp(applications).serve(command.sessionPath, process.env.WAKE_MCP_TOKEN ?? '');
+            return;
         case 'audit':
             for (const record of await applications.audit.read(command.workItemId))
                 output.write(`${JSON.stringify(record)}\n`);
@@ -247,6 +273,11 @@ function auth(applications) {
         throw new Error('UI auth CLI application was not composed');
     return applications.auth;
 }
+function mcp(applications) {
+    if (applications.mcp === undefined)
+        throw new Error('MCP CLI application was not composed');
+    return applications.mcp;
+}
 function writeResult(output, value) {
     if (value !== undefined)
         output.write(`${JSON.stringify(value)}\n`);

package/dist/src/surfaces/cli/usage.js

@@ -14,6 +14,7 @@ export const usage = [
     '  wake ui token set <key>    Replace the UI login access key',
     '  wake audit                 Show autonomous decision audit history',
     '  wake correlate             Manually correlate a resource to a work item',
+    '  wake mcp serve             Run the private run-scoped Wake MCP transport',
     '  wake run resolve           Resolve an escalated ambiguous run',
     '  wake doctor                Diagnose config/GitHub/Docker/sandbox setup problems',
     '  wake maintenance clear     Clear an abandoned failed self-update maintenance lease',

package/dist/src/surfaces/index.d.ts

@@ -45,6 +45,7 @@ export * from './cli/infrastructure/process-log.js';
 export * from './cli/infrastructure/sandbox-startup-failure.js';
 export * from './cli/main.js';
 export * from './cli/usage.js';
+export * from './mcp/stdio.js';
 export * from './contracts/config.js';
 export * from './web-host/asset-source.js';
 export * from './web-host/packaged-assets.js';

package/dist/src/surfaces/index.js

@@ -45,6 +45,7 @@ export * from './cli/infrastructure/process-log.js';
 export * from './cli/infrastructure/sandbox-startup-failure.js';
 export * from './cli/main.js';
 export * from './cli/usage.js';
+export * from './mcp/stdio.js';
 export * from './contracts/config.js';
 export * from './web-host/asset-source.js';
 export * from './web-host/packaged-assets.js';

package/dist/src/surfaces/mcp/stdio.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/** Surface transport only: Bootstrap supplies the already-authorized tool server. */
+export declare function serveMcpOverStdio(server: McpServer): Promise<void>;

package/dist/src/surfaces/mcp/stdio.js

@@ -0,0 +1,5 @@
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+/** Surface transport only: Bootstrap supplies the already-authorized tool server. */
+export async function serveMcpOverStdio(server) {
+    await server.connect(new StdioServerTransport());
+}