@botiverse/oar 0.59.1 → 0.61.0

package/README.md

@@ -212,6 +212,38 @@ conversation database, refuses an entry carrying them. See the
 [channels](https://github.com/botiverse/oar/blob/main/docs/spec/runtime-matrix.md#refused-session-options)
 and each runtime page's "Session MCP servers".
 
+Tools the host implements itself go through the same option. `serveMcpTools`
+serves them from an MCP server inside the host process and returns the
+`mcpServers` entry to pass, so one implementation reaches every runtime that
+takes an http entry with `headers` (all but cursor, pi-durable and antigravity):
+
+```ts
+import { serveMcpTools } from "@botiverse/oar";
+
+const served = await serveMcpTools({
+  name: "workspace",
+  tools: [{
+    name: "read_note",
+    description: "Read a note from the host's store",
+    inputSchema: { type: "object", properties: { id: { type: "string" } }, required: ["id"] },
+    handler: async ({ id }, { signal }) => await notes.read(String(id), { signal }),
+  }],
+});
+const session = await runtime.session(installation, { cwd, mcpServers: [served.server] });
+// ... later, after the sessions that use it are disposed:
+await served.close();
+```
+
+It listens on 127.0.0.1 behind a random bearer token (in the entry's
+`headers`, so it never appears in a record), so the runtime must run on this
+machine, as OAR's runtimes do. A handler returns text, or MCP content with
+`isError` for a failed call; a thrown error becomes an `isError` result with
+its message. Its `signal` aborts when the runtime cancels the call or the
+server closes. One served set can back several sessions. `instructions` (guidance
+across the tools) goes out as the MCP server instructions; claude, codex,
+opencode and grok show them to the model, pi and kimi do not. See
+[host-served tools](https://github.com/botiverse/oar/blob/main/docs/spec/runtime-matrix.md#host-served-tools).
+
 `runtime.listModels(installation, options?)` lists the models an installation
 can run now (`ok`, `unauthenticated` or `unsupported`); every built-in runtime
 has it. Entries include native `effortLevels` and `serviceTiers` where supported.

package/dist/index.d.ts

@@ -4,6 +4,8 @@ export { utcInstantFromDate } from "./shared/instant.js";
 export { RuntimeRegistry, createRuntimeRegistry } from "./registry.js";
 export { VOYAGE_FORMAT, endLine, headerLine, openVoyage, recordLine, } from "./voyage.js";
 export type { VoyageHeader, VoyageRecorder } from "./voyage.js";
+export { serveMcpTools } from "./mcp/serve-tools.js";
+export type { HostTool, HostToolContent, HostToolResult, ServeMcpToolsOptions, ServedMcpTools } from "./mcp/serve-tools.js";
 export * from "./observe/index.js";
 export { claudeRuntime } from "./runtimes/claude/index.js";
 export { claudeListModels, projectClaudeModels } from "./runtimes/claude/list-models.js";
@@ -23,7 +25,7 @@ export { antigravityInstallation } from "./runtimes/antigravity/installation.js"
 export { antigravityListModels, projectAntigravityModels } from "./runtimes/antigravity/list-models.js";
 export { createCursorRuntime, projectCursorModels } from "./runtimes/cursor/index.js";
 export type { CursorRuntime, CursorRuntimeOptions } from "./runtimes/cursor/index.js";
-export type { CursorSdk } from "./runtimes/cursor/sdk.js";
+export type { CursorSdk, ModelListItem as CursorModelListItem } from "./runtimes/cursor/sdk.js";
 export { cursorInstallation } from "./runtimes/cursor/installation.js";
 export { grokRuntime } from "./runtimes/grok/index.js";
 export { grokListModels, projectGrokModels } from "./runtimes/grok/list-models.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAShD,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EACL,aAAa,EACb,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEhE,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtF,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACtF,YAAY,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,iBAQ1B,CAAC;AAEH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC9D,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAShD,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EACL,aAAa,EACb,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE5H,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtF,YAAY,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACtF,YAAY,EAAE,SAAS,EAAE,aAAa,IAAI,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,iBAQ1B,CAAC;AAEH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC9D,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -10,6 +10,7 @@ export * from "./contracts/index.js";
 export { utcInstantFromDate } from "./shared/instant.js";
 export { RuntimeRegistry, createRuntimeRegistry } from "./registry.js";
 export { VOYAGE_FORMAT, endLine, headerLine, openVoyage, recordLine, } from "./voyage.js";
+export { serveMcpTools } from "./mcp/serve-tools.js";
 // Everything the browser-safe observe subpath exports, so the root is the full surface.
 export * from "./observe/index.js";
 export { claudeRuntime } from "./runtimes/claude/index.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EACL,aAAa,EACb,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,wFAAwF;AACxF,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC;IACjD,kBAAkB;IAClB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,WAAW;IACX,eAAe;IACf,SAAS;CACV,CAAC,CAAC;AAEH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,cAAc,sBAAsB,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EACL,aAAa,EACb,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,wFAAwF;AACxF,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAC;AACxG,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGtF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC/F,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,eAAe,CAAC;IACjD,kBAAkB;IAClB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,WAAW;IACX,eAAe;IACf,SAAS;CACV,CAAC,CAAC;AAEH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC"}

package/dist/mcp/http.d.ts

@@ -0,0 +1,12 @@
+import type { IncomingMessage, Server, ServerResponse } from "node:http";
+import { type JsonRecord } from "../shared/json.js";
+export declare function authorized(request: IncomingMessage, expected: Buffer): boolean;
+/** No Origin (a runtime's MCP client), or a loopback page's: MCP asks servers to refuse other origins (DNS rebinding). */
+export declare function localOrigin(request: IncomingMessage): boolean;
+/** The request body, or null past MAX_BODY_BYTES. The rest is still read: answering before the client finished sending resets its connection (seen on Windows). */
+export declare function body(request: IncomingMessage): Promise<string | null>;
+export declare function rpcError(response: ServerResponse, code: number, message: string): void;
+/** The request's messages: one, or a batch (2025-03-26). */
+export declare function messagesOf(parsed: unknown): JsonRecord[] | null;
+export declare function listen(server: Server): Promise<number>;
+//# sourceMappingURL=http.d.ts.map

package/dist/mcp/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEzE,OAAO,EAAY,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM9D,wBAAgB,UAAU,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG9E;AAED,0HAA0H;AAC1H,wBAAgB,WAAW,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAU7D;AAED,mKAAmK;AACnK,wBAAsB,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAS3E;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAEtF;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU,EAAE,GAAG,IAAI,CAS/D;AAED,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5D"}

package/dist/mcp/http.js

@@ -0,0 +1,66 @@
+import { timingSafeEqual } from "node:crypto";
+import { asRecord } from "../shared/json.js";
+/* The HTTP side of serve-tools.ts: authorization, origin, bodies and replies. */
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+export function authorized(request, expected) {
+    const given = Buffer.from(request.headers.authorization ?? "");
+    return given.length === expected.length && timingSafeEqual(given, expected);
+}
+/** No Origin (a runtime's MCP client), or a loopback page's: MCP asks servers to refuse other origins (DNS rebinding). */
+export function localOrigin(request) {
+    const { origin } = request.headers;
+    if (origin === undefined) {
+        return true;
+    }
+    try {
+        return ["127.0.0.1", "localhost", "[::1]"].includes(new URL(origin).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+/** The request body, or null past MAX_BODY_BYTES. The rest is still read: answering before the client finished sending resets its connection (seen on Windows). */
+export async function body(request) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+        size += buffer.length;
+        if (size <= MAX_BODY_BYTES) {
+            chunks.push(buffer);
+        }
+    }
+    return size > MAX_BODY_BYTES ? null : Buffer.concat(chunks).toString("utf8");
+}
+export function rpcError(response, code, message) {
+    response.writeHead(400, { "content-type": "application/json" }).end(JSON.stringify({ jsonrpc: "2.0", id: null, error: { code, message } }));
+}
+/** The request's messages: one, or a batch (2025-03-26). */
+export function messagesOf(parsed) {
+    const list = Array.isArray(parsed) ? parsed : [parsed];
+    const messages = [];
+    for (const entry of list) {
+        const message = asRecord(entry);
+        if (message === null) {
+            return null;
+        }
+        messages.push(message);
+    }
+    return messages.length > 0 ? messages : null;
+}
+export async function listen(server) {
+    const { promise, resolve, reject } = Promise.withResolvers();
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+        const address = server.address();
+        if (address !== null && typeof address === "object") {
+            resolve(address.port);
+        }
+        else {
+            reject(new Error("serveMcpTools: no TCP port"));
+        }
+    });
+    const port = await promise;
+    return port;
+}
+//# sourceMappingURL=http.js.map

package/dist/mcp/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/mcp/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,OAAO,EAAE,QAAQ,EAAmB,MAAM,mBAAmB,CAAC;AAE9D,iFAAiF;AAEjF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,MAAM,UAAU,UAAU,CAAC,OAAwB,EAAE,QAAgB;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,WAAW,CAAC,OAAwB;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mKAAmK;AACnK,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAwB;IACjD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;QACtB,IAAI,IAAI,IAAI,cAAc,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;IACtD,CAAC;IACD,OAAO,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAwB,EAAE,IAAY,EAAE,OAAe;IAC9E,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9I,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,MAAM,IAAI,GAAc,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACtC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAc;IACzC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,EAAU,CAAC;IACrE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;QACjC,MAAM,OAAO,GAAgC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;aAAM,CAAC;YAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAAC,CAAC;IAC3I,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/mcp/serve-tools.d.ts

@@ -0,0 +1,60 @@
+import type { McpServer } from "../contracts/session-options.js";
+/** Content a host tool returns, in MCP's own shapes. */
+export type HostToolContent = {
+    readonly type: "text";
+    readonly text: string;
+} | {
+    readonly type: "image";
+    readonly data: string;
+    readonly mimeType: string;
+};
+/** A tool's answer: plain text, or MCP content with `isError` for a failed call the model should see. */
+export type HostToolResult = string | {
+    readonly content: readonly HostToolContent[];
+    readonly isError?: boolean;
+};
+export interface HostTool {
+    /** The tool name the model sees (`^[\w-]{1,64}$`); runtimes may prefix it with the server name. */
+    readonly name: string;
+    readonly description?: string;
+    /** JSON Schema of the input, an object schema, given to the runtime unchanged. OAR does not validate calls against it. */
+    readonly inputSchema: Readonly<Record<string, unknown>>;
+    /**
+     * Runs one call. `signal` aborts when the runtime cancels the call, drops
+     * the request, or the server closes. A thrown error becomes an `isError`
+     * result carrying the error's message.
+     */
+    readonly handler: (input: Readonly<Record<string, unknown>>, context: {
+        readonly signal: AbortSignal;
+    }) => HostToolResult | Promise<HostToolResult>;
+}
+export interface ServeMcpToolsOptions {
+    /** The server name runtimes show and prefix tools with (`^[\w-]+$`, the strictest runtime's rule). */
+    readonly name: string;
+    readonly tools: readonly HostTool[];
+    /**
+     * Guidance across the tools (what the group is for, how they work
+     * together), returned as the MCP `initialize` result's `instructions`.
+     * Whether the model sees it is the runtime's own choice: see
+     * docs/spec/runtime-matrix.md#host-served-tools.
+     */
+    readonly instructions?: string;
+}
+export interface ServedMcpTools {
+    /** The `SessionOptions.mcpServers` entry: http on 127.0.0.1 with the bearer token in `headers`. */
+    readonly server: Extract<McpServer, {
+        readonly type: "http";
+    }>;
+    /** Stops serving and aborts calls still running. */
+    close(): Promise<void>;
+}
+/**
+ * Serve host-implemented tools over MCP for `SessionOptions.mcpServers`.
+ * Pass `served.server` in a session's `mcpServers`; one served set can back
+ * several sessions. The runtime must reach the host's 127.0.0.1 (it does when
+ * OAR starts it on this machine or runs it in this process). Runtimes that
+ * refuse an http entry or its `headers` refuse this one too (cursor,
+ * pi-durable, antigravity): see docs/spec/runtime-matrix.md#host-served-tools.
+ */
+export declare function serveMcpTools(options: ServeMcpToolsOptions): Promise<ServedMcpTools>;
+//# sourceMappingURL=serve-tools.d.ts.map

package/dist/mcp/serve-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/serve-tools.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAkBjE,wDAAwD;AACxD,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,yGAAyG;AACzG,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEnH,MAAM,WAAW,QAAQ;IACvB,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,0HAA0H;IAC1H,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;KAAE,KAAK,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACrJ;AAED,MAAM,WAAW,oBAAoB;IACnC,sGAAsG;IACtG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/D,oDAAoD;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAgKD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAqB1F"}

package/dist/mcp/serve-tools.js

@@ -0,0 +1,196 @@
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { asRecord, parseJson } from "../shared/json.js";
+import { authorized, body, listen, localOrigin, messagesOf, rpcError } from "./http.js";
+const SERVER_NAME = /^[\w-]+$/u;
+const TOOL_NAME = /^[\w-]{1,64}$/u;
+function checkTools(options) {
+    if (!SERVER_NAME.test(options.name)) {
+        throw new Error(`serveMcpTools name ${JSON.stringify(options.name)} must match ${String(SERVER_NAME)}`);
+    }
+    const tools = new Map();
+    for (const tool of options.tools) {
+        if (!TOOL_NAME.test(tool.name) || tools.has(tool.name)) {
+            throw new Error(`serveMcpTools tool name ${JSON.stringify(tool.name)} must match ${String(TOOL_NAME)} and be unique`);
+        }
+        tools.set(tool.name, tool);
+    }
+    return tools;
+}
+function listed(tool) {
+    const entry = { name: tool.name, inputSchema: tool.inputSchema };
+    if (tool.description !== undefined) {
+        entry.description = tool.description;
+    }
+    return entry;
+}
+function toolResult(result) {
+    if (typeof result === "string") {
+        return { content: [{ type: "text", text: result }] };
+    }
+    return { content: [...result.content], ...(result.isError === true ? { isError: true } : {}) };
+}
+/** The protocol versions this server speaks; a client asking for another gets the latest. */
+const PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+class ToolServer {
+    #name;
+    #instructions;
+    #tools;
+    /** Running calls by MCP session and request id: clients number requests alike, so an id alone is not one call. */
+    #calls = new Map();
+    constructor(options, tools) {
+        this.#name = options.name;
+        this.#instructions = options.instructions;
+        this.#tools = tools;
+    }
+    /** The JSON-RPC answer to one message, or null for a notification or a client's response. */
+    async answer(message, origin) {
+        const { id, method } = message;
+        const params = asRecord(message.params) ?? {};
+        if (typeof method !== "string") {
+            return null;
+        }
+        if (typeof id !== "string" && typeof id !== "number") {
+            const cancelled = params.requestId;
+            if (method === "notifications/cancelled" && (typeof cancelled === "string" || typeof cancelled === "number")) {
+                this.#calls.get(callKey(origin.session, cancelled))?.abort();
+            }
+            return null;
+        }
+        const reply = await this.#result(id, method, params, origin);
+        return { jsonrpc: "2.0", id, ...reply };
+    }
+    abortAll() {
+        for (const controller of this.#calls.values()) {
+            controller.abort();
+        }
+    }
+    async #result(id, method, params, origin) {
+        switch (method) {
+            case "initialize":
+                return { result: {
+                        protocolVersion: typeof params.protocolVersion === "string" && PROTOCOL_VERSIONS.includes(params.protocolVersion) ? params.protocolVersion : PROTOCOL_VERSIONS[0],
+                        capabilities: { tools: {} },
+                        serverInfo: { name: this.#name, version: "1.0.0" },
+                        ...(this.#instructions === undefined ? {} : { instructions: this.#instructions }),
+                    } };
+            case "ping":
+                return { result: {} };
+            case "tools/list":
+                return { result: { tools: [...this.#tools.values()].map((tool) => listed(tool)) } };
+            case "tools/call": {
+                const reply = await this.#call(callKey(origin.session, id), params, origin.dropped);
+                return reply;
+            }
+            default:
+                return { error: { code: -32_601, message: `method not found: ${method}` } };
+        }
+    }
+    async #call(key, params, dropped) {
+        const tool = typeof params.name === "string" ? this.#tools.get(params.name) : undefined;
+        if (tool === undefined) {
+            return { error: { code: -32_602, message: `unknown tool: ${String(params.name)}` } };
+        }
+        const controller = new AbortController();
+        const abort = () => { controller.abort(); };
+        dropped.addEventListener("abort", abort, { once: true });
+        this.#calls.set(key, controller);
+        try {
+            return { result: toolResult(await tool.handler(asRecord(params.arguments) ?? {}, { signal: controller.signal })) };
+        }
+        catch (error) {
+            return { result: { content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }], isError: true } };
+        }
+        finally {
+            if (this.#calls.get(key) === controller) {
+                this.#calls.delete(key);
+            }
+            dropped.removeEventListener("abort", abort);
+        }
+    }
+}
+function callKey(session, id) {
+    return JSON.stringify([session, id]);
+}
+async function respond(tools, request, response) {
+    const text = await body(request);
+    if (text === null) {
+        response.writeHead(413, { connection: "close" }).end();
+        return;
+    }
+    const parsed = parseJson(text);
+    const messages = messagesOf(parsed);
+    if (messages === null) {
+        rpcError(response, parsed === undefined ? -32_700 : -32_600, parsed === undefined ? "parse error" : "invalid request");
+        return;
+    }
+    // A new MCP session per initialize, so each client's request ids are its own.
+    const opened = messages.some((message) => message.method === "initialize") ? `oar-host-tools-${randomBytes(12).toString("hex")}` : undefined;
+    const header = request.headers["mcp-session-id"];
+    const session = opened ?? (typeof header === "string" ? header : "");
+    const dropped = new AbortController();
+    response.once("close", () => { if (!response.writableEnded) {
+        dropped.abort();
+    } });
+    const answered = await Promise.all(messages.map(async (message) => {
+        const reply = await tools.answer(message, { session, dropped: dropped.signal });
+        return reply;
+    }));
+    const replies = answered.filter((reply) => reply !== null);
+    if (replies.length === 0) {
+        response.writeHead(202).end();
+        return;
+    }
+    response.writeHead(200, { "content-type": "application/json", ...(session === "" ? {} : { "mcp-session-id": session }) }).end(JSON.stringify(Array.isArray(parsed) ? replies : replies[0]));
+}
+/** One authorized POST, never rejecting: a failure the reply did not cover becomes a 500. */
+async function serve(tools, request, response) {
+    try {
+        await respond(tools, request, response);
+    }
+    catch {
+        if (!response.headersSent) {
+            response.writeHead(500).end();
+        }
+    }
+}
+/**
+ * Serve host-implemented tools over MCP for `SessionOptions.mcpServers`.
+ * Pass `served.server` in a session's `mcpServers`; one served set can back
+ * several sessions. The runtime must reach the host's 127.0.0.1 (it does when
+ * OAR starts it on this machine or runs it in this process). Runtimes that
+ * refuse an http entry or its `headers` refuse this one too (cursor,
+ * pi-durable, antigravity): see docs/spec/runtime-matrix.md#host-served-tools.
+ */
+export async function serveMcpTools(options) {
+    const tools = new ToolServer(options, checkTools(options));
+    const token = randomBytes(32).toString("base64url");
+    const expected = Buffer.from(`Bearer ${token}`);
+    const server = createServer((request, response) => {
+        if (!localOrigin(request)) {
+            response.writeHead(403).end();
+            return;
+        }
+        if (!authorized(request, expected)) {
+            response.writeHead(401).end();
+            return;
+        }
+        if (request.method !== "POST") {
+            response.writeHead(405, { allow: "POST" }).end();
+            return;
+        }
+        void serve(tools, request, response);
+    });
+    const port = await listen(server);
+    return {
+        server: { name: options.name, type: "http", url: `http://127.0.0.1:${String(port)}/mcp`, headers: { Authorization: `Bearer ${token}` } },
+        async close() {
+            tools.abortAll();
+            const { promise, resolve } = Promise.withResolvers();
+            server.close(() => { resolve(); });
+            server.closeAllConnections();
+            await promise;
+        },
+    };
+}
+//# sourceMappingURL=serve-tools.js.map

package/dist/mcp/serve-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-tools.js","sourceRoot":"","sources":["../../src/mcp/serve-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAEpF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAmB,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AA0DxF,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAGnC,SAAS,UAAU,CAAC,OAA6B;IAC/C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,IAAc;IAC5B,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAAC,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IAAC,CAAC;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,MAAsB;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,6FAA6F;AAC7F,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;AAQrE,MAAM,UAAU;IACL,KAAK,CAAS;IACd,aAAa,CAAqB;IAClC,MAAM,CAAgC;IAC/C,kHAAkH;IACzG,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAErD,YAAY,OAA6B,EAAE,KAAoC;QAC7E,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,MAAM,CAAC,OAAmB,EAAE,MAAc;QAC9C,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;YACnC,IAAI,MAAM,KAAK,yBAAyB,IAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;YAAC,CAAC;YAC/K,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,QAAQ;QACN,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,MAAc,EAAE,MAAkB,EAAE,MAAc;QAC1E,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,YAAY;gBACf,OAAO,EAAE,MAAM,EAAE;wBACf,eAAe,EAAE,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;wBACjK,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;wBAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;wBAClD,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;qBAClF,EAAE,CAAC;YACN,KAAK,MAAM;gBACT,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACxB,KAAK,YAAY;gBACf,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACtF,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACpF,OAAO,KAAK,CAAC;YACf,CAAC;YACD;gBACE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,qBAAqB,MAAM,EAAE,EAAE,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,MAAkB,EAAE,OAAoB;QAC/D,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC;QACvF,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;QACrH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAClI,CAAC;gBAAS,CAAC;YACT,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YACrE,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;CACF;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,EAAU;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,KAAiB,EAAE,OAAwB,EAAE,QAAwB;IAC1F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACvD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACvH,OAAO;IACT,CAAC;IACD,8EAA8E;IAC9E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,kBAAkB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7I,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9L,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,KAAK,CAAC,KAAiB,EAAE,OAAwB,EAAE,QAAwB;IACxF,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA6B;IAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;QAChD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QACrE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC5F,KAAK,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO;QACL,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE;QACxI,KAAK,CAAC,KAAK;YACT,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,aAAa,EAAQ,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@botiverse/oar",
-  "version": "0.59.1",
+  "version": "0.61.0",
   "description": "A programming interface for all agent harnesses: provider-independent contracts for controlling and observing agent runtimes",
   "type": "module",
   "main": "./dist/index.js",