@corenel/mcp 0.1.0

package/LICENSE

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor's trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising out
+of these terms or the use or nature of the software, under any kind of legal
+claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion of
+it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over, are
+under the control of, or are under common control with that organization.
+**control** means ownership of substantially all the assets of an entity, or the
+power to direct its management and policies by vote, contract, or otherwise.
+Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under these
+terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

package/dist/asAgentTools.d.ts

@@ -0,0 +1,12 @@
+import type { AgentTool } from '@corenel/protocol';
+import type { McpRegistry } from './registry';
+/** Build one `AgentTool` per registry entry, in the registry's order.
+ *
+ * A server/tool pair whose name can't be safely packed into a wire name
+ * (see toolNames.ts's module comment for the exact rule) contributes NO
+ * tool -- silently dropping it would mean a user who added a server never
+ * finds out one of its tools is simply missing, so the refusal is logged to
+ * stderr, matching this package's existing convention for loud, user-facing
+ * CLI failures (cli.ts's `console.error` calls). */
+export declare function asAgentTools(registry: McpRegistry): AgentTool[];
+//# sourceMappingURL=asAgentTools.d.ts.map

package/dist/asAgentTools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asAgentTools.d.ts","sourceRoot":"","sources":["../src/asAgentTools.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAoC9C;;;;;;;oDAOoD;AACpD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,EAAE,CAa/D"}

package/dist/asAgentTools.js

@@ -0,0 +1,71 @@
+import { canEncodeMcpWireName, mcpToolAddress, mcpWireName } from './toolNames.js';
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/** `McpTool.inputSchema` is `unknown` -- some servers send no schema at all,
+ *  or something that isn't a JSON Schema object. Never pass that through as
+ *  `undefined`: an `AgentTool` with no `parameters` is one a model can call
+ *  with any arguments at all, which is worse than an (accurate) empty one. */
+function toParameters(inputSchema) {
+    if (isPlainObject(inputSchema))
+        return inputSchema;
+    return { type: 'object', properties: {} };
+}
+/** MCP's `tools/call` result content is `unknown` by the time it reaches
+ *  here (httpClient.ts passes the JSON-RPC `result.content` through as-is).
+ *  The common shape per the MCP spec is an array of content blocks
+ *  (`{ type: 'text', text }` and friends); join the text blocks the way the
+ *  model expects a tool result to read, and fall back to JSON for anything
+ *  that isn't that shape rather than losing the payload. */
+function formatContent(content) {
+    if (typeof content === 'string')
+        return content;
+    if (Array.isArray(content)) {
+        const parts = content.map((block) => {
+            if (isPlainObject(block) && typeof block.text === 'string')
+                return block.text;
+            return JSON.stringify(block);
+        });
+        return parts.join('\n');
+    }
+    if (content == null)
+        return '';
+    return JSON.stringify(content);
+}
+/** Build one `AgentTool` per registry entry, in the registry's order.
+ *
+ * A server/tool pair whose name can't be safely packed into a wire name
+ * (see toolNames.ts's module comment for the exact rule) contributes NO
+ * tool -- silently dropping it would mean a user who added a server never
+ * finds out one of its tools is simply missing, so the refusal is logged to
+ * stderr, matching this package's existing convention for loud, user-facing
+ * CLI failures (cli.ts's `console.error` calls). */
+export function asAgentTools(registry) {
+    const out = [];
+    for (const { server, tool } of registry.tools()) {
+        if (!canEncodeMcpWireName(server, tool.name)) {
+            console.error(`MCP tool refused: server "${server}" tool "${tool.name}" cannot be encoded as a wire name ` +
+                '(unsupported characters or too long) -- this tool is not available to the model');
+            continue;
+        }
+        out.push(toAgentTool(registry, server, tool));
+    }
+    return out;
+}
+function toAgentTool(registry, server, tool) {
+    const name = mcpWireName(server, tool.name);
+    const address = mcpToolAddress(server, tool.name);
+    return {
+        name,
+        namespace: 'mcp',
+        description: tool.description?.trim() || `MCP tool "${tool.name}" on server "${server}" (${address}).`,
+        parameters: toParameters(tool.inputSchema),
+        mutates: true,
+        async run(args) {
+            const result = await registry.call(server, tool.name, args);
+            const text = formatContent(result.content);
+            return result.isError ? `Error: ${text}` : text;
+        },
+    };
+}
+//# sourceMappingURL=asAgentTools.js.map

package/dist/asAgentTools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asAgentTools.js","sourceRoot":"","sources":["../src/asAgentTools.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEhF,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;8EAG8E;AAC9E,SAAS,YAAY,CAAC,WAAoB;IACxC,IAAI,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;4DAK4D;AAC5D,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAClC,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC;YAC9E,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;oDAOoD;AACpD,MAAM,UAAU,YAAY,CAAC,QAAqB;IAChD,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CACX,6BAA6B,MAAM,WAAW,IAAI,CAAC,IAAI,qCAAqC;gBAC1F,iFAAiF,CACpF,CAAC;YACF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,QAAqB,EAAE,MAAc,EAAE,IAAa;IACvE,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,aAAa,IAAI,CAAC,IAAI,gBAAgB,MAAM,MAAM,OAAO,IAAI;QACtG,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC;QAC1C,OAAO,EAAE,IAAI;QACb,KAAK,CAAC,GAAG,CAAC,IAAI;YACZ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth.d.ts

@@ -0,0 +1,25 @@
+import type { McpServer } from './types';
+export interface AuthProvider {
+    /** Headers to send with a request. Throws when the server has no usable
+     *  credential stored (never logged in, or an OAuth refresh failed) -- there
+     *  is nothing safe to send, and the caller should surface that as "run
+     *  `corenel mcp login <name>`" rather than send an empty/stale header. */
+    headers(): Promise<{
+        name: string;
+        value: string;
+    }[]>;
+    /** Call after the SERVER returns 401. Returns true when a credential was
+     *  refreshed and the call is worth retrying; false when there was nothing
+     *  to refresh (headers credential, no refresh token, or the refresh
+     *  itself failed) -- retrying in that case is pure latency. */
+    onUnauthorized(): Promise<boolean>;
+}
+/**
+ * Build the `AuthProvider` for one configured MCP server.
+ *
+ * `fetchImpl` defaults to the global `fetch` and exists so a test can inject
+ * a stub without a real socket -- production callers (Task 6) pass none and
+ * get the real network.
+ */
+export declare function authProviderFor(stateDir: string, server: McpServer, fetchImpl?: typeof fetch, accountToken?: () => Promise<string | null>): AuthProvider;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAsB,MAAM,SAAS,CAAC;AAI7D,MAAM,WAAW,YAAY;IAC3B;;;8EAG0E;IAC1E,OAAO,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACtD;;;mEAG+D;IAC/D,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACpC;AASD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,SAAS,EACjB,SAAS,GAAE,OAAO,KAAa,EAW/B,YAAY,GAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAoB,GAC5D,YAAY,CAmDd"}

package/dist/auth.js

@@ -0,0 +1,97 @@
+/* THE SEAM: how an MCP HTTP CLIENT (Task 6) authenticates a request without
+ * ever learning whether the credential behind it is a static header or a
+ * live OAuth token.
+ *
+ * `AuthProvider` is the whole of that contract:
+ *
+ *   - `headers()` returns the request headers to send. For a `headers`
+ *     credential that is just the stored list. For an `oauth` credential it
+ *     is `Authorization: Bearer <accessToken>` -- refreshing FIRST if the
+ *     stored token is expired (or expiring within the skew window;
+ *     `oauth/tokens.ts`'s `isExpired`), so the caller never sends a token it
+ *     already knows is stale.
+ *   - `onUnauthorized()` is what a caller runs after the SERVER, not this
+ *     module, says 401 -- the token looked fresh by the clock but the server
+ *     disagreed (clock skew beyond the margin, a revoked token, whatever).
+ *     It returns true when it refreshed a credential worth retrying with,
+ *     false when there was nothing to do. A `headers` credential has no
+ *     refresh concept at all, so it returns false immediately -- retrying a
+ *     static header that was just rejected is pure latency, never a fix.
+ *
+ * This module owns the refresh (`oauth/tokens.ts`) and expiry decision, and
+ * persists a refreshed credential back through `writeMcpCredential` before
+ * handing out its headers -- Task 6's client must never read or write
+ * auth.json itself, or the two would drift the way daemon.json/auth.json
+ * already drift when two writers touch one file without a merge (see
+ * mcp/config.ts's module comment).
+ */
+import { readMcpCredential, writeMcpCredential } from './config.js';
+import { discoverAuthMetadata } from './oauth/discovery.js';
+import { refresh as refreshOAuthToken, isExpired } from './oauth/tokens.js';
+/**
+ * Build the `AuthProvider` for one configured MCP server.
+ *
+ * `fetchImpl` defaults to the global `fetch` and exists so a test can inject
+ * a stub without a real socket -- production callers (Task 6) pass none and
+ * get the real network.
+ */
+export function authProviderFor(stateDir, server, fetchImpl = fetch, 
+/* The daemon's OWN account token, read LIVE rather than stored. Only used for
+ * a `hosted` server, where the relay needs to know which account is calling.
+ *
+ * Live and not stored because that token is a short-lived OAuth access token
+ * with a refresh behind it: a copy pasted into a static header is frozen at
+ * the moment it was pasted and starts failing within the hour -- with a 401
+ * that reads as an MCP problem rather than an expiry. Null means signed out,
+ * which is deliberately sent as NO header at all: the relay's own "not
+ * authenticated" is a better answer than the MCP server saying something
+ * about Microsoft. */
+accountToken = async () => null) {
+    async function doRefresh(cred) {
+        if (!cred.refreshToken) {
+            throw new Error(`"${server.name}" has no refresh token on file -- run: corenel mcp login ${server.name}`);
+        }
+        const meta = await discoverAuthMetadata(cred.authServer, fetchImpl);
+        const refreshed = await refreshOAuthToken(meta, cred, fetchImpl);
+        await writeMcpCredential(stateDir, server.name, refreshed);
+        return refreshed;
+    }
+    return {
+        async headers() {
+            const cred = await readMcpCredential(stateDir, server.name);
+            /* A HOSTED server may legitimately have no credential yet: the relay is
+             * still reachable with the account token alone, and the upstream 401 is
+             * what carries the WWW-Authenticate that starts the OAuth flow. A direct
+             * server with no credential has nowhere to go, so it still refuses. */
+            if (!cred && !server.hosted) {
+                throw new Error(`No credential stored for MCP server "${server.name}" -- run: corenel mcp login ${server.name} (or set-header, for a static token).`);
+            }
+            const mcpHeaders = !cred ? []
+                : cred.kind === 'headers' ? cred.headers
+                    : [{ name: 'Authorization', value: `Bearer ${(isExpired(cred, Date.now()) ? await doRefresh(cred) : cred).accessToken}` }];
+            if (!server.hosted)
+                return mcpHeaders;
+            /* Only the header that authenticates to the MCP SERVER moves aside --
+             * `Authorization`. A server wanting `X-Api-Key` is authenticating with
+             * that, and moving it would break it for no reason. */
+            const moved = mcpHeaders.map((h) => (h.name.toLowerCase() === 'authorization' ? { name: 'X-MCP-Authorization', value: h.value } : h));
+            const account = await accountToken();
+            return account ? [...moved, { name: 'Authorization', value: `Bearer ${account}` }] : moved;
+        },
+        async onUnauthorized() {
+            const cred = await readMcpCredential(stateDir, server.name);
+            // Nothing to refresh: no credential at all, or a static header --
+            // retrying a header the server just rejected fixes nothing.
+            if (!cred || cred.kind !== 'oauth')
+                return false;
+            try {
+                await doRefresh(cred);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAsBzE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,MAAiB,EACjB,YAA0B,KAAK;AAC/B;;;;;;;;;sBASsB;AACtB,eAA6C,KAAK,IAAI,EAAE,CAAC,IAAI;IAE7D,KAAK,UAAU,SAAS,CAAC,IAAwB;QAC/C,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,4DAA4D,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,SAAsC,CAAC,CAAC;QACjG,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,SAAoC,CAAC,CAAC;QAC5F,MAAM,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO;YACX,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5D;;;mFAGuE;YACvE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,IAAI,+BAA+B,MAAM,CAAC,IAAI,uCAAuC,CAAC,CAAC;YACxJ,CAAC;YAED,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBAC3B,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;oBACtC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAE/H,IAAI,CAAC,MAAM,CAAC,MAAM;gBAAE,OAAO,UAAU,CAAC;YAEtC;;mEAEuD;YACvD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAClC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAC/F,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7F,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5D,kEAAkE;YAClE,4DAA4D;YAC5D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/cache.d.ts

@@ -0,0 +1,17 @@
+import type { McpTool } from './httpClient';
+import type { McpServer, McpCredential } from './types';
+export interface CachedServer {
+    url: string;
+    fingerprint: string;
+    /** Epoch ms, shown as cache age in /mcp. */
+    fetchedAt: number;
+    tools: McpTool[];
+}
+export declare function toolCachePath(stateDir: string): string;
+/** Identifies WHICH credential was in force without revealing it. Re-authenticating
+ *  changes this, which is what drops the stale tool list. */
+export declare function credentialFingerprint(cred: McpCredential | null): string;
+export declare function readToolCache(stateDir: string): Promise<Record<string, CachedServer>>;
+export declare function writeToolCache(stateDir: string, cache: Record<string, CachedServer>): Promise<void>;
+export declare function cacheEntryFor(cache: Record<string, CachedServer>, server: McpServer, cred: McpCredential | null): CachedServer | null;
+//# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;6DAC6D;AAC7D,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,GAAG,MAAM,CAMxE;AAgBD,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAe3F;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAQzG;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,EACnC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,aAAa,GAAG,IAAI,GACzB,YAAY,GAAG,IAAI,CAMrB"}

package/dist/cache.js

@@ -0,0 +1,81 @@
+/* THE CACHE THAT LETS A TERMINAL START COLD.
+ *
+ * McpRegistry.connectAll opens a socket per server with a 30s deadline each.
+ * A daemon pays that once; a TUI launched fifty times a day cannot pay it at
+ * all. So the CLI reads tool lists from here at startup and opens a
+ * connection only when something actually reaches for a tool.
+ *
+ * The fingerprint is a HASH, never the credential. This file sits in the same
+ * dot-dir as auth.json but carries none of its secrecy guarantees -- it exists
+ * to be read quickly at startup, and a token copied into it would be a
+ * credential in a file nobody thinks of as one.
+ */
+import { createHash } from 'node:crypto';
+import { readFile, writeFile, mkdir, rename } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+export function toolCachePath(stateDir) {
+    return join(stateDir, 'mcp-tools.json');
+}
+/** Identifies WHICH credential was in force without revealing it. Re-authenticating
+ *  changes this, which is what drops the stale tool list. */
+export function credentialFingerprint(cred) {
+    if (!cred)
+        return 'none';
+    const material = cred.kind === 'headers'
+        ? `headers:${cred.headers.map((h) => `${h.name}=${h.value}`).sort().join('\u0000')}`
+        : `oauth:${cred.accessToken}\u0000${cred.clientId}\u0000${cred.authServer}`;
+    return createHash('sha256').update(material).digest('hex').slice(0, 16);
+}
+/** A cache file is untrusted input: it can be hand-edited, half-written by a
+ *  crash, or left behind by an older version. An entry that does not match the
+ *  shape is DROPPED rather than repaired -- the cost of dropping one is a single
+ *  network connection, and the cost of trusting it is malformed tool definitions
+ *  reaching the model. */
+function isCachedServer(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return false;
+    const e = v;
+    return typeof e.url === 'string'
+        && typeof e.fingerprint === 'string'
+        && typeof e.fetchedAt === 'number'
+        && Array.isArray(e.tools);
+}
+export async function readToolCache(stateDir) {
+    try {
+        const raw = await readFile(toolCachePath(stateDir), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return {};
+        const out = {};
+        for (const [name, entry] of Object.entries(parsed)) {
+            if (isCachedServer(entry))
+                out[name] = entry;
+        }
+        return out;
+    }
+    catch {
+        // A missing, unreadable or corrupt cache is not an error: it means the next
+        // tool reach opens a connection. Never let it stop startup.
+        return {};
+    }
+}
+export async function writeToolCache(stateDir, cache) {
+    const path = toolCachePath(stateDir);
+    await mkdir(dirname(path), { recursive: true });
+    // Temp-then-rename: a crash or a second terminal writing concurrently must not
+    // leave a half-written cache behind. rename() is atomic on Windows and POSIX.
+    const tmp = `${path}.${process.pid}.tmp`;
+    await writeFile(tmp, `${JSON.stringify(cache, null, 2)}\n`, 'utf8');
+    await rename(tmp, path);
+}
+export function cacheEntryFor(cache, server, cred) {
+    const hit = cache[server.name];
+    if (!hit)
+        return null;
+    if (hit.url !== server.url)
+        return null;
+    if (hit.fingerprint !== credentialFingerprint(cred))
+        return null;
+    return hit;
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAY1C,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;6DAC6D;AAC7D,MAAM,UAAU,qBAAqB,CAAC,IAA0B;IAC9D,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS;QACtC,CAAC,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QACpF,CAAC,CAAC,SAAS,IAAI,CAAC,WAAW,SAAS,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;IAC9E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;0BAI0B;AAC1B,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,CAAC,GAAG,CAA0B,CAAC;IACrC,OAAO,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;WAC3B,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;WACjC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;WAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9E,MAAM,GAAG,GAAiC,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC9E,IAAI,cAAc,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,4DAA4D;QAC5D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,KAAmC;IACxF,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACzC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAmC,EACnC,MAAiB,EACjB,IAA0B;IAE1B,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,GAAG,CAAC,WAAW,KAAK,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,71 @@
+import type { McpServer, McpCredential } from './types';
+/**
+ * The configured MCP servers, or `[]` on a machine that has none.
+ *
+ * `readDaemonConfig` does not deep-validate a known key -- a hand-edited
+ * daemon.json can carry anything under `mcpServers` -- so this filters to
+ * entries that are actually usable, dropping the rest rather than serving a
+ * half-populated server (missing url, wrong type, not an object at all).
+ */
+export declare function readMcpServers(stateDir: string): Promise<McpServer[]>;
+/** Write the server list through daemon.json, preserving every other key --
+ *  including keys this process does not know about, via the `unknown` bucket
+ *  `readDaemonConfig` already separates out. */
+export declare function writeMcpServers(stateDir: string, servers: McpServer[]): Promise<void>;
+/** The stored credential for `server`, or null when it has none. A malformed
+ *  `mcp` section, a malformed entry within it, or an entry that is not a
+ *  usable credential of either kind all read as "no credential" rather than
+ *  throwing -- matching how a corrupt auth.json is already treated elsewhere
+ *  in this package. */
+export declare function readMcpCredential(stateDir: string, server: string): Promise<McpCredential | null>;
+/**
+ * Store `server`'s credential, merging into auth.json rather than replacing
+ * it -- see the module comment. A secret written here never touches
+ * daemon.json: this function is the only writer of the `mcp` section, and it
+ * writes exclusively to auth.json.
+ */
+/** A dynamic client registration, kept so we do not mint a new one per sign-in. */
+export interface McpRegisteredClient {
+    clientId: string;
+    clientSecret?: string;
+    /** The authorization server it was registered WITH. A server that changes its
+     *  authorization server invalidates the registration, and reusing one across
+     *  that change sends a client_id the new server has never issued. */
+    authServer: string;
+    /** A FIXED loopback port for the redirect, when the authorization server
+     *  will not honour RFC 8252 s7.3 (which requires accepting ANY port on a
+     *  loopback redirect URI).
+     *
+     *  Slack matches redirect URLs exactly, so the single URL an operator
+     *  registers in their own app settings has to name the port the daemon will
+     *  actually listen on -- an ephemeral one could never match it. Absent
+     *  everywhere else, where a random port is both free of collisions and one
+     *  less thing for an operator to keep in sync. */
+    redirectPort?: number;
+}
+/**
+ * The OAuth client previously registered for `server`, or null.
+ *
+ * WHY THIS IS STORED AT ALL. Every sign-in used to perform a fresh dynamic
+ * client registration, so each click on Sign in minted another OAuth client at
+ * the vendor. Servers rate-limit that -- Figma answers 403 after a few -- and
+ * the refusal surfaces as a sign-in failure on a service that works, with
+ * nothing to suggest the cause is our own retry.
+ *
+ * Reuse is safe across the random loopback PORT this picks per attempt: RFC
+ * 8252 section 7.3 requires an authorization server to accept any port for a
+ * loopback redirect URI. `authServer` is stored so a registration is dropped
+ * if the server later points somewhere else, which is the one case where a
+ * cached client_id would be presented to something that never issued it.
+ */
+export declare function readMcpClient(stateDir: string, server: string): Promise<McpRegisteredClient | null>;
+/** Store `server`'s registered client, merging into auth.json exactly as
+ *  writeMcpCredential does -- same file, same 0600, same preservation of every
+ *  other key including ones this build knows nothing about. */
+export declare function writeMcpClient(stateDir: string, server: string, client: McpRegisteredClient): Promise<void>;
+/** Forget `server`'s registered client, so the next sign-in registers afresh.
+ *  Used when a server rejects the stored client_id -- the registration is gone
+ *  on their side and keeping it only reproduces the failure. */
+export declare function clearMcpClient(stateDir: string, server: string): Promise<void>;
+export declare function writeMcpCredential(stateDir: string, server: string, cred: McpCredential): Promise<void>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAUxD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAyB3E;AAED;;gDAEgD;AAChD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG3F;AAmDD;;;;uBAIuB;AACvB,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAMvG;AAED;;;;;GAKG;AACH,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;yEAEqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;;;sDAQkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAMzG;AAED;;+DAE+D;AAC/D,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBjH;AAED;;gEAEgE;AAChE,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYpF;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAa7G"}