@corenel/mcp 0.1.0

package/dist/policy.js

@@ -0,0 +1,71 @@
+/* The MCP policy gate — the single check nothing under `mcp:` may run
+ * without. Task 10 (daemon wiring) and Task 11 (socket messages) both sit
+ * downstream of this; this file owns the actual security decision.
+ *
+ * Deny by default, and NAME THE TOOL not the server:
+ *
+ * An MCP server describes its own tool list at runtime — there is no static
+ * catalog an operator can review the way there is for `fs:*`/`shell:*`
+ * before writing a policy. The ordinary guardrail's `tools.allow` treats an
+ * EMPTY list as "no restriction" (see `evaluateToolCall` in
+ * `packages/harness/guardrail/guardrail.ts`: `if (allow.length && ...)`).
+ * That default is wrong here, so this module never reuses that code path —
+ * an `mcp:` address with no matching entry is refused, full stop.
+ *
+ * The allow-list entry must match the exact `mcp:<server>/<tool>` address.
+ * Reusing the existing glob matcher (`matchesAnyGlob`) gets "names the tool,
+ * not the server" for free, with no special case: `mcp:teams` as a glob
+ * pattern has no `*` in it, so it matches only the literal string
+ * "mcp:teams" — never "mcp:teams/post_message". A server that starts with
+ * only read tools and later grows a destructive one must not inherit trust
+ * granted before that tool existed; an operator who really means "trust
+ * every tool this server ever exposes" has to write `mcp:teams/*` and mean
+ * it.
+ *
+ * Why every MCP tool is treated as mutating: `readOnlyHint` is an optional
+ * hint volunteered BY the server being evaluated for trust, so "read a page"
+ * and "post a message" arrive indistinguishable. This is the same rule the
+ * ACP work already established (an unknown tool kind MUST mean mutating, or
+ * unlabelled destructive calls auto-approve) — restated here rather than
+ * trusting any annotation the server itself supplies.
+ *
+ * Never prompts: an `ask` permission level normally means the ordinary
+ * `PermissionService.check` calls out to a human via a `PermissionPrompt`.
+ * The motivating case for MCP tools is an agent finishing an unattended job
+ * and messaging out about it — nobody is there to answer, so `ask` would
+ * hang the run rather than protect it. This function is synchronous and
+ * never holds a `PermissionPrompt`, but that alone isn't enough: Task 10's
+ * wiring could still name a tool in `tools.allow` and then separately run it
+ * through `PermissionService.check`, which WOULD prompt if the resolved
+ * level is "ask" and a prompt handler is wired up. So this gate resolves the
+ * permission level itself and refuses outright on anything but "allow" —
+ * `ask` and `deny` both come back as a refusal, never as an invitation to
+ * ask elsewhere. `defaultForReadOnly`/`defaultForMutating` are overridden to
+ * "allow" so an address with NO explicit entry in `permissions` /
+ * `mutatingDefault` / `defaultPermission` isn't itself vetoed by the
+ * ordinary "mutating tools ask by default" heuristic — being named in
+ * `tools.allow` is what authorises it; only an EXPLICIT ask/deny rule left
+ * in the policy can still veto it here.
+ */
+import { PermissionService, matchesAnyGlob } from '@corenel/harness/guardrail';
+/** Deny-by-default gate for one `mcp:<server>/<tool>` address. */
+export function mcpCallAllowed(address, policy) {
+    const allow = policy.tools?.allow ?? [];
+    if (!matchesAnyGlob(address, allow)) {
+        return { ok: false, reason: `${address} is not allowed - add it with: corenel config add mcpAllow ${address}` };
+    }
+    const service = new PermissionService({
+        policy,
+        defaultForReadOnly: 'allow',
+        defaultForMutating: 'allow',
+    });
+    const level = service.resolveLevel({ name: address, address, mutates: true });
+    if (level !== 'allow') {
+        return {
+            ok: false,
+            reason: `${address} resolves to permission "${level}" - MCP tools never prompt; set it to "allow" or remove the rule`,
+        };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK/E,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,8DAA8D,OAAO,EAAE,EAAE,CAAC;IAClH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;QACpC,MAAM;QACN,kBAAkB,EAAE,OAAO;QAC3B,kBAAkB,EAAE,OAAO;KAC5B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,OAAO,4BAA4B,KAAK,kEAAkE;SACtH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,124 @@
+import type { McpServer } from './types';
+import type { McpTool } from './httpClient';
+import type { CachedServer } from './cache';
+/** The subset of `McpHttpClient` the registry needs. Named separately (not
+ *  just `McpHttpClient` itself) so a test double can implement it without
+ *  standing up the real class or its constructor's auth/fetch plumbing. */
+export interface McpClient {
+    initialize(): Promise<void>;
+    listTools(): Promise<McpTool[]>;
+    callTool(name: string, args: unknown): Promise<{
+        content: unknown;
+        isError: boolean;
+    }>;
+}
+/** Builds the client to use for one server. Defaults to the real
+ *  `McpHttpClient` wired to the real `authProviderFor`; a test supplies a
+ *  factory that returns a fake and never touches the network or the auth
+ *  store. */
+export type McpClientFactory = (stateDir: string, server: McpServer) => McpClient;
+/**
+ * The daemon's OWN Corenel account token, or null when it has none.
+ *
+ * Exported because it is the part with behaviour: a relayed server is refused
+ * by api.corenel.ai's own auth without it, and the daemon reports that as
+ * `refused the credential (401)` -- which reads as a Microsoft problem and is
+ * not one.
+ *
+ * Null on ANY failure, deliberately. Signed out, no credential file, an
+ * unreadable one: all mean the same thing to the caller, and authProviderFor
+ * turns null into "send no Authorization header" so the relay answers its own
+ * clear "not authenticated" rather than something about Microsoft.
+ */
+export declare function accountTokenFor(stateDir: string): Promise<string | null>;
+/** One server's outcome, connected or not, for `status()` to report. Kept
+ *  separately from `Connected` (rather than folding an optional client onto
+ *  one record) so a failed server carries exactly the fields it can: no
+ *  tools, no client, an error naming why. */
+interface ServerStatus {
+    connected: boolean;
+    toolCount: number;
+    error?: string;
+}
+/** The longest one server may take to connect -- credential refresh,
+ *  initialize and tools/list together -- before it is reported as timed out
+ *  and the daemon moves on without it. Generous for a cold service; short
+ *  enough that a stalled one reads as a failure, not a hang. */
+export declare const SERVER_CONNECT_TIMEOUT_MS = 30000;
+/** One server's outcome, as reported the moment it settles. */
+export type ServerReport = {
+    server: string;
+} & ServerStatus;
+export interface ConnectAllOptions {
+    /** Per-server connect deadline; defaults to SERVER_CONNECT_TIMEOUT_MS. */
+    timeoutMs?: number;
+    /** Called once per server as soon as it settles -- connected, failed or
+     *  timed out -- so a caller can report progress instead of going silent
+     *  until the slowest server finishes. */
+    onServer?: (report: ServerReport) => void;
+}
+export declare class McpRegistry {
+    private readonly stateDir;
+    private readonly clientFactory;
+    private readonly connected;
+    private readonly statuses;
+    private serverOrder;
+    private readonly primed;
+    private readonly connecting;
+    constructor(stateDir: string, clientFactory?: McpClientFactory);
+    /**
+     * Connect to every configured server and cache its tools. Never throws --
+     * a server that fails to initialize, or fails listing tools, is recorded
+     * in `status()` with zero tools and the daemon keeps starting.
+     */
+    connectAll(opts?: ConnectAllOptions): Promise<void>;
+    private connectOne;
+    /** Every tool from every connected OR primed server, paired with the server
+     *  it came from, in CONFIGURED order (`serverOrder`) -- not the order
+     *  servers happened to finish connecting in, and not insertion order into
+     *  `primed` either. Within a server, tools stay in the order that server
+     *  returned them. A live connection wins over a primed (cached) entry for
+     *  the same server, since it is the fresher truth. A server with neither
+     *  either failed to connect or reported zero tools -- `status()` tells the
+     *  two apart. */
+    tools(): {
+        server: string;
+        tool: McpTool;
+    }[];
+    /** Seed tool lists from the on-disk cache. NO I/O, no sockets -- this is
+     *  what a terminal calls at startup so that `tools()` can answer
+     *  immediately, before any server has actually been reached. A primed
+     *  server is deliberately NOT `connected`: it can answer what tools exist,
+     *  and cannot call one until `ensureConnected()` has run. */
+    primeFromCache(cache: Record<string, CachedServer>): void;
+    isConnected(server: string): boolean;
+    connectedServers(): string[];
+    /** Connect ONE server, on demand. Never throws, for the same reason
+     *  connectAll never throws: a server that is down must not take the
+     *  process with it. Concurrent callers for the same server share one
+     *  attempt rather than opening a second socket. */
+    ensureConnected(server: string): Promise<void>;
+    /**
+     * Call one tool on one server. Fails immediately, naming the server, when
+     * that server never connected -- there is nothing to route the call
+     * through, and pretending otherwise would either stall waiting on a
+     * connection that will never appear or return an empty result the caller
+     * could mistake for a genuine (if empty) tool response.
+     */
+    call(server: string, tool: string, args: unknown): Promise<{
+        content: unknown;
+        isError: boolean;
+    }>;
+    /** Per-server connection state, for `doctor` (Task 10) to print. A server
+     *  with `connected: false` always carries `error` -- there is no code path
+     *  that records a failure without a reason, because "no tools" alone tells
+     *  the reader nothing about what to fix. */
+    status(): {
+        server: string;
+        connected: boolean;
+        toolCount: number;
+        error?: string;
+    }[];
+}
+export {};
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAM5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C;;2EAE2E;AAC3E,MAAM,WAAW,SAAS;IACxB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,SAAS,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxF;AAED;;;aAGa;AACb,MAAM,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,SAAS,CAAC;AAElF;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO9E;AAmCD;;;6CAG6C;AAC7C,UAAU,YAAY;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;gEAGgE;AAChE,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,+DAA+D;AAC/D,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;6CAEyC;IACzC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;CAC3C;AAED,qBAAa,WAAW;IA0BpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IA1BhC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAW5D,OAAO,CAAC,WAAW,CAAgB;IAMnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;IAIvD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoC;gBAG5C,QAAQ,EAAE,MAAM,EAChB,aAAa,GAAE,gBAAuC;IAGzE;;;;OAIG;IACG,UAAU,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;YAiC/C,UAAU;IAyCxB;;;;;;;qBAOiB;IACjB,KAAK,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,EAAE;IAW5C;;;;iEAI6D;IAC7D,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,IAAI;IAQzD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAIpC,gBAAgB,IAAI,MAAM,EAAE;IAI5B;;;uDAGmD;IAC7C,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAqBpD;;;;;;OAMG;IACG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAYxG;;;gDAG4C;IAC5C,MAAM,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE;CAYtF"}

package/dist/registry.js

@@ -0,0 +1,265 @@
+import { McpHttpClient } from './httpClient.js';
+import { authProviderFor } from './auth.js';
+import { resolveCredential } from '@corenel/config';
+import { readMcpServers } from './config.js';
+import { timedFetch, AUTH_REQUEST_TIMEOUT_MS } from './timedFetch.js';
+/**
+ * The daemon's OWN Corenel account token, or null when it has none.
+ *
+ * Exported because it is the part with behaviour: a relayed server is refused
+ * by api.corenel.ai's own auth without it, and the daemon reports that as
+ * `refused the credential (401)` -- which reads as a Microsoft problem and is
+ * not one.
+ *
+ * Null on ANY failure, deliberately. Signed out, no credential file, an
+ * unreadable one: all mean the same thing to the caller, and authProviderFor
+ * turns null into "send no Authorization header" so the relay answers its own
+ * clear "not authenticated" rather than something about Microsoft.
+ */
+export async function accountTokenFor(stateDir) {
+    try {
+        const cred = await resolveCredential(process.env, stateDir);
+        return cred.token ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function defaultClientFactory(stateDir, server) {
+    /* THE FOURTH ARGUMENT IS WHY A HOSTED SERVER WORKS AT ALL, and omitting it
+     * was silent. A relayed server needs TWO credentials: the MCP one in
+     * `X-MCP-Authorization`, and the daemon's own Corenel account token in
+     * `Authorization` so the relay knows whose account to rate limit. With no
+     * token supplied, authProviderFor takes its signed-out path and sends no
+     * Authorization at all -- so api.corenel.ai's own clerkAuth refuses the call,
+     * and the daemon reports it as `refused the credential (401)`, which reads as
+     * a Microsoft problem and is not one.
+     *
+     * Passed as a FUNCTION, read per request. That token is a short-lived OAuth
+     * access token with a refresh behind it; capturing its value here would work
+     * for an hour and then fail with the same misleading 401. */
+    /* THE REFRESH CHAIN GETS A DEADLINE; THE CLIENT DOES NOT.
+     *
+     * An expired credential is refreshed inside `auth.headers()` -- discovery,
+     * then a token POST -- and with no deadline a cold authorization server held
+     * daemon startup indefinitely. Those requests are never legitimately slow.
+     * A tool CALL can be, so the client keeps plain fetch; connect time is bounded
+     * per server by `connectAll` instead. */
+    return new McpHttpClient(server, authProviderFor(stateDir, server, timedFetch(AUTH_REQUEST_TIMEOUT_MS), () => accountTokenFor(stateDir)));
+}
+/** The longest one server may take to connect -- credential refresh,
+ *  initialize and tools/list together -- before it is reported as timed out
+ *  and the daemon moves on without it. Generous for a cold service; short
+ *  enough that a stalled one reads as a failure, not a hang. */
+export const SERVER_CONNECT_TIMEOUT_MS = 30_000;
+export class McpRegistry {
+    stateDir;
+    clientFactory;
+    connected = new Map();
+    statuses = new Map();
+    // The order the operator wrote servers in daemon.json, captured once per
+    // connectAll() -- `tools()` walks THIS, never `connected`'s Map iteration
+    // order. `connectOne` runs concurrently for every server (Promise.all), so
+    // Map insertion order is race order: whichever server's initialize+list
+    // happened to resolve first. That is fine for `connected` (a lookup table,
+    // order never read) but `tools()` is a list a model/doctor/policy consumes
+    // in order, and race order means a different tool ordering on every daemon
+    // boot -- exactly the kind of bug that surfaces far from here and is never
+    // traced back. Configured order is also information the operator supplied
+    // deliberately; sorting alphabetically would discard it.
+    serverOrder = [];
+    // Tool lists seeded from the on-disk cache, with no socket ever opened.
+    // Deliberately a THIRD piece of state, not folded into `connected`: a
+    // primed server can answer `tools()` but must still go through
+    // `ensureConnected` before `call()` will dispatch to it. `connectAll`
+    // does not touch this map -- see the comment at its first line for why.
+    primed = new Map();
+    // One in-flight ensureConnected() attempt per server, so three tool calls
+    // that land on the same cold server in the same turn share one connection
+    // instead of racing three.
+    connecting = new Map();
+    constructor(stateDir, clientFactory = defaultClientFactory) {
+        this.stateDir = stateDir;
+        this.clientFactory = clientFactory;
+    }
+    /**
+     * Connect to every configured server and cache its tools. Never throws --
+     * a server that fails to initialize, or fails listing tools, is recorded
+     * in `status()` with zero tools and the daemon keeps starting.
+     */
+    async connectAll(opts = {}) {
+        this.connected.clear();
+        this.statuses.clear();
+        // Cleared too, deliberately: connectAll is a full, authoritative resync.
+        // A primed entry is a cache's word for what a server's tools USED to be;
+        // once connectAll has actually tried the server and recorded the truth in
+        // `statuses`, leaving a stale primed entry behind would let `tools()`
+        // report tools for a server `status()` just said failed to connect --
+        // the two would disagree. The daemon never calls primeFromCache at all,
+        // so today this is a no-op for it; it matters only if a future caller
+        // primes and then does a full connectAll on the same registry.
+        this.primed.clear();
+        const servers = await readMcpServers(this.stateDir);
+        this.serverOrder = servers.map((s) => s.name);
+        const timeoutMs = opts.timeoutMs ?? SERVER_CONNECT_TIMEOUT_MS;
+        await Promise.all(servers.map((server) => this.connectOne(server, timeoutMs, opts.onServer)));
+    }
+    /* BOUNDED, AND SETTLED EXACTLY ONCE.
+     *
+     * Every server connects under one Promise.all, and daemon startup awaits it.
+     * With no bound, one stalled server -- measured: an expired Microsoft 365
+     * token refreshing against a cold service, still waiting at 60 seconds --
+     * left the terminal silent after `mirrors sessions`, indistinguishable from a
+     * crash.
+     *
+     * The deadline covers the whole connect (any credential refresh, initialize,
+     * tools/list), not each request, because several individually bounded steps
+     * in a row can still add up to a hang. The attempt that loses the race keeps
+     * running; its late result is deliberately ignored, so a server reported as
+     * timed out cannot quietly become connected afterwards -- status would then
+     * tell doctor one thing and the registered tools another. */
+    async connectOne(server, timeoutMs, onServer) {
+        let timer;
+        const deadline = new Promise((resolve) => {
+            timer = setTimeout(() => resolve('timeout'), timeoutMs);
+        });
+        const attempt = (async () => {
+            const client = this.clientFactory(this.stateDir, server);
+            await client.initialize();
+            // If this throws after the server already sent tools over the wire,
+            // McpHttpClient's `listTools()` still resolves or rejects as ONE
+            // array -- there is no partial array to accidentally keep here. Do
+            // not refactor this into a loop that pushes tools one at a time; that
+            // would reintroduce the exact partial-list bug this module exists to
+            // prevent.
+            const tools = await client.listTools();
+            return { client, tools };
+        })();
+        // The loser of the race must not surface later as an unhandled rejection.
+        attempt.catch(() => { });
+        try {
+            const outcome = await Promise.race([attempt, deadline]);
+            if (outcome === 'timeout') {
+                this.statuses.set(server.name, { connected: false, toolCount: 0, error: `timed out after ${timeoutMs / 1000}s` });
+            }
+            else {
+                this.connected.set(server.name, outcome);
+                this.statuses.set(server.name, { connected: true, toolCount: outcome.tools.length });
+            }
+        }
+        catch (err) {
+            this.statuses.set(server.name, {
+                connected: false,
+                toolCount: 0,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const settled = this.statuses.get(server.name);
+        if (settled)
+            onServer?.({ server: server.name, ...settled });
+    }
+    /** Every tool from every connected OR primed server, paired with the server
+     *  it came from, in CONFIGURED order (`serverOrder`) -- not the order
+     *  servers happened to finish connecting in, and not insertion order into
+     *  `primed` either. Within a server, tools stay in the order that server
+     *  returned them. A live connection wins over a primed (cached) entry for
+     *  the same server, since it is the fresher truth. A server with neither
+     *  either failed to connect or reported zero tools -- `status()` tells the
+     *  two apart. */
+    tools() {
+        const out = [];
+        for (const server of this.serverOrder) {
+            const entry = this.connected.get(server);
+            const list = entry ? entry.tools : this.primed.get(server);
+            if (!list)
+                continue;
+            for (const tool of list)
+                out.push({ server, tool });
+        }
+        return out;
+    }
+    /** Seed tool lists from the on-disk cache. NO I/O, no sockets -- this is
+     *  what a terminal calls at startup so that `tools()` can answer
+     *  immediately, before any server has actually been reached. A primed
+     *  server is deliberately NOT `connected`: it can answer what tools exist,
+     *  and cannot call one until `ensureConnected()` has run. */
+    primeFromCache(cache) {
+        for (const [name, entry] of Object.entries(cache)) {
+            this.statuses.set(name, { connected: false, toolCount: entry.tools.length });
+            this.primed.set(name, entry.tools);
+            if (!this.serverOrder.includes(name))
+                this.serverOrder.push(name);
+        }
+    }
+    isConnected(server) {
+        return this.connected.has(server);
+    }
+    connectedServers() {
+        return this.serverOrder.filter((s) => this.connected.has(s));
+    }
+    /** Connect ONE server, on demand. Never throws, for the same reason
+     *  connectAll never throws: a server that is down must not take the
+     *  process with it. Concurrent callers for the same server share one
+     *  attempt rather than opening a second socket. */
+    async ensureConnected(server) {
+        if (this.connected.has(server))
+            return;
+        const inflight = this.connecting.get(server);
+        if (inflight)
+            return inflight;
+        const attempt = (async () => {
+            const servers = await readMcpServers(this.stateDir);
+            const def = servers.find((s) => s.name === server);
+            if (!def)
+                return;
+            // A server reached only through ensureConnected (never primed, never
+            // through connectAll) has no place in serverOrder yet -- add it now so
+            // connectedServers()/tools()/status() all agree on its position rather
+            // than silently dropping it.
+            if (!this.serverOrder.includes(server))
+                this.serverOrder.push(server);
+            await this.connectOne(def, SERVER_CONNECT_TIMEOUT_MS);
+        })().finally(() => this.connecting.delete(server));
+        this.connecting.set(server, attempt);
+        return attempt;
+    }
+    /**
+     * Call one tool on one server. Fails immediately, naming the server, when
+     * that server never connected -- there is nothing to route the call
+     * through, and pretending otherwise would either stall waiting on a
+     * connection that will never appear or return an empty result the caller
+     * could mistake for a genuine (if empty) tool response.
+     */
+    async call(server, tool, args) {
+        // A cached-but-cold server (primed, never connected) gets its one socket
+        // opened here, on first actual use, rather than failing outright just
+        // because nothing had reached for it yet.
+        await this.ensureConnected(server);
+        const entry = this.connected.get(server);
+        if (!entry) {
+            throw new Error(`MCP server "${server}" is not connected -- run: corenel mcp doctor`);
+        }
+        return entry.client.callTool(tool, args);
+    }
+    /** Per-server connection state, for `doctor` (Task 10) to print. A server
+     *  with `connected: false` always carries `error` -- there is no code path
+     *  that records a failure without a reason, because "no tools" alone tells
+     *  the reader nothing about what to fix. */
+    status() {
+        /* CONFIGURED order, for the same reason `tools()` uses it. `statuses` fills
+         * in whichever order servers settle, and now that a stalled server is cut
+         * off at a deadline rather than waited on, that order changes from boot to
+         * boot -- doctor would list the same servers differently every run. */
+        const out = [];
+        for (const server of this.serverOrder) {
+            const s = this.statuses.get(server);
+            if (s)
+                out.push({ server, ...s });
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAkBnE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,MAAiB;IAC/D;;;;;;;;;;;iEAW6D;IAC7D;;;;;;6CAMyC;IACzC,OAAO,IAAI,aAAa,CACtB,MAAM,EACN,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,uBAAuB,CAAC,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CACxG,CAAC;AACJ,CAAC;AAmBD;;;gEAGgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAchD,MAAM,OAAO,WAAW;IA0BH;IACA;IA1BF,SAAS,GAAG,IAAI,GAAG,EAAqB,CAAC;IACzC,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC5D,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,yDAAyD;IACjD,WAAW,GAAa,EAAE,CAAC;IACnC,wEAAwE;IACxE,sEAAsE;IACtE,+DAA+D;IAC/D,sEAAsE;IACtE,wEAAwE;IACvD,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IACvD,0EAA0E;IAC1E,0EAA0E;IAC1E,2BAA2B;IACV,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE/D,YACmB,QAAgB,EAChB,gBAAkC,oBAAoB;QADtD,aAAQ,GAAR,QAAQ,CAAQ;QAChB,kBAAa,GAAb,aAAa,CAAyC;IACtE,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,OAA0B,EAAE;QAC3C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAEpB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,yBAAyB,CAAC;QAC9D,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED;;;;;;;;;;;;;iEAa6D;IACrD,KAAK,CAAC,UAAU,CAAC,MAAiB,EAAE,SAAiB,EAAE,QAAoC;QACjG,IAAI,KAAgD,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;YAClD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;YAC1B,oEAAoE;YACpE,iEAAiE;YACjE,mEAAmE;YACnE,sEAAsE;YACtE,qEAAqE;YACrE,WAAW;YACX,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC,CAAC,EAAE,CAAC;QACL,0EAA0E;QAC1E,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAA4D,CAAC,CAAC,CAAC;QAElF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;YACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,mBAAmB,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;YACpH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;gBAC7B,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,CAAC;gBACZ,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;qBAOiB;IACjB,KAAK;QACH,MAAM,GAAG,GAAwC,EAAE,CAAC;QACpD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,KAAK,MAAM,IAAI,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;iEAI6D;IAC7D,cAAc,CAAC,KAAmC;QAChD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;uDAGmD;IACnD,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,6BAA6B;YAC7B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAEnD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,IAAY,EAAE,IAAa;QACpD,yEAAyE;QACzE,sEAAsE;QACtE,0CAA0C;QAC1C,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,+CAA+C,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;gDAG4C;IAC5C,MAAM;QACJ;;;+EAGuE;QACvE,MAAM,GAAG,GAAgF,EAAE,CAAC;QAC5F,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/timedFetch.d.ts

@@ -0,0 +1,10 @@
+/** How long one refresh-chain request may take before it is abandoned. */
+export declare const AUTH_REQUEST_TIMEOUT_MS = 15000;
+/** Wrap `inner` so every request gives up after `ms`.
+ *
+ *  The caller's own signal still applies: a deadline adds a bound, it never
+ *  removes the ability to cancel sooner. A timeout is reported as
+ *  "no answer within Ns" so the error names what happened rather than
+ *  surfacing a bare AbortError. */
+export declare function timedFetch(ms: number, inner?: typeof fetch): typeof fetch;
+//# sourceMappingURL=timedFetch.d.ts.map

package/dist/timedFetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timedFetch.d.ts","sourceRoot":"","sources":["../src/timedFetch.ts"],"names":[],"mappings":"AAgBA,0EAA0E;AAC1E,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C;;;;;mCAKmC;AACnC,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,GAAE,OAAO,KAAa,GAAG,OAAO,KAAK,CAahF"}

package/dist/timedFetch.js

@@ -0,0 +1,39 @@
+/* A fetch with a deadline.
+ *
+ * Used for the OAuth refresh chain -- discovery, then the token POST -- which
+ * runs inside `auth.headers()` whenever a stored credential has expired. That
+ * chain carried no signal at all, so an expired Microsoft 365 token refreshing
+ * against a cold Cloud Run service could hold a daemon's startup indefinitely
+ * (measured: still waiting at 60 seconds; Node's own header wait is five
+ * minutes).
+ *
+ * NOT used for MCP tool calls. A real tool call -- a Graph batch, a long
+ * search -- can legitimately take longer than any deadline short enough to
+ * make startup feel responsive, and cutting one off would turn a slow answer
+ * into a wrong one. Connect time is bounded separately, per server, by the
+ * registry.
+ */
+/** How long one refresh-chain request may take before it is abandoned. */
+export const AUTH_REQUEST_TIMEOUT_MS = 15_000;
+/** Wrap `inner` so every request gives up after `ms`.
+ *
+ *  The caller's own signal still applies: a deadline adds a bound, it never
+ *  removes the ability to cancel sooner. A timeout is reported as
+ *  "no answer within Ns" so the error names what happened rather than
+ *  surfacing a bare AbortError. */
+export function timedFetch(ms, inner = fetch) {
+    return (async (input, init = {}) => {
+        const deadline = AbortSignal.timeout(ms);
+        const signal = init.signal ? AbortSignal.any([init.signal, deadline]) : deadline;
+        try {
+            return await inner(input, { ...init, signal });
+        }
+        catch (err) {
+            if (deadline.aborted && !init.signal?.aborted) {
+                throw new Error(`no answer within ${ms / 1000}s`, { cause: err });
+            }
+            throw err;
+        }
+    });
+}
+//# sourceMappingURL=timedFetch.js.map

package/dist/timedFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timedFetch.js","sourceRoot":"","sources":["../src/timedFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C;;;;;mCAKmC;AACnC,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,QAAsB,KAAK;IAChE,OAAO,CAAC,KAAK,EAAE,KAAkC,EAAE,OAAoB,EAAE,EAAE,EAAE;QAC3E,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjF,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,GAAG,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAiB,CAAC;AACrB,CAAC"}

package/dist/toolNames.d.ts

@@ -0,0 +1,2 @@
+export { mcpToolAddress, parseMcpToolAddress, mcpWireName, parseMcpWireName, canEncodeMcpWireName, looksLikeMcpWireName, } from '@corenel/protocol';
+//# sourceMappingURL=toolNames.d.ts.map

package/dist/toolNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolNames.d.ts","sourceRoot":"","sources":["../src/toolNames.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC"}

package/dist/toolNames.js

@@ -0,0 +1,14 @@
+/* Re-exports @corenel/protocol's MCP tool-naming scheme (wire name <->
+ * address). The encoding itself moved to packages/protocol/mcpToolNames.ts
+ * so packages/harness/tools/namespaces.ts -- shared with the browser, and
+ * not allowed to depend on this Node-only package -- can produce the SAME
+ * address `asAgentTools` puts on each `AgentTool.name`, rather than two
+ * independent implementations of the same scheme silently drifting apart.
+ * See that file's module comment for the full design (escaping choices,
+ * the refuse-vs-escape split between address and wire name, and why the
+ * legacy `mcp__server__tool` shape is handled separately).
+ *
+ * This module exists so nothing under packages/sidecar/src/mcp had to change
+ * its import path. */
+export { mcpToolAddress, parseMcpToolAddress, mcpWireName, parseMcpWireName, canEncodeMcpWireName, looksLikeMcpWireName, } from '@corenel/protocol';
+//# sourceMappingURL=toolNames.js.map

package/dist/toolNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolNames.js","sourceRoot":"","sources":["../src/toolNames.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;sBAWsB;AACtB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,62 @@
+/** One configured MCP server. No secret material -- see McpCredential. */
+export interface McpServer {
+    name: string;
+    url: string;
+    /** Reached through OUR relay (api.corenel.ai/mcp/hosted/<name>) rather than
+     *  directly. Such a call carries TWO credentials: the daemon's own account
+     *  token in `Authorization`, so the API can attribute and rate-limit it, and
+     *  the MCP server's credential in `X-MCP-Authorization`, which the relay
+     *  swaps back on the way out.
+     *
+     *  A FLAG ON THE SERVER, not a credential kind, because "how do I
+     *  authenticate to this server" and "how do I reach it" are different
+     *  questions. As a kind it would need a `-headers` and an `-oauth` variant
+     *  and another for every kind added later; as a flag it composes with all
+     *  of them. */
+    hosted?: boolean;
+    /** Where to SIGN IN, when that is not where calls go.
+     *
+     *  A relayed server splits in two: calls go through the Corenel relay so it
+     *  can rate limit them per account, while the OAuth dance -- discovery,
+     *  /authorize, /token -- happens directly against the hosted service, whose
+     *  gate leaves those paths public so nobody sits in the middle of an auth
+     *  exchange.
+     *
+     *  Absent for every other server, where `url` answers both questions. When
+     *  absent the login flow uses `url`, which is what it always did. */
+    authUrl?: string;
+}
+/** A credential presented as static request headers -- an API key, a bearer
+ *  token issued out of band, a basic-auth value. Whatever the server wants,
+ *  the header text is the whole of it. */
+export interface McpHeadersCredential {
+    kind: 'headers';
+    headers: {
+        name: string;
+        value: string;
+    }[];
+}
+/**
+ * A credential from an OAuth flow against the MCP server's own auth server.
+ *
+ * `refreshToken` is itself a credential -- long-lived, and the thing an
+ * attacker who reads this file would actually want -- so every reader and
+ * writer that touches it must treat it exactly as it treats accessToken:
+ * never logged, never printed, never mirrored into daemon.json.
+ *
+ * `expiresAt` absent means the issuer did not say, matching the same
+ * convention as tools-node's StoredCredential -- NOT "does not expire".
+ */
+export interface McpOAuthCredential {
+    kind: 'oauth';
+    accessToken: string;
+    refreshToken?: string;
+    /** Epoch ms. Absent means the issuer did not say. */
+    expiresAt?: number;
+    clientId: string;
+    clientSecret?: string;
+    authServer: string;
+    scope?: string;
+}
+export type McpCredential = McpHeadersCredential | McpOAuthCredential;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAkBA,0EAA0E;AAC1E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;;;;;mBAUe;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB;;;;;;;;;yEASqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;0CAE0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,aAAa,GAAG,oBAAoB,GAAG,kBAAkB,CAAC"}