@cruxy/cli 1.0.2 → 1.0.4

package/dist/lsp/service.d.ts

@@ -1,44 +0,0 @@
-import type { CruxyConfig } from "../config/index.js";
-import type { BinaryPresent, LspDiagnostic, LspHover, LspLocation, TransportFactory } from "./types.js";
-/** Logger surface the service reports through (matches the indexing service). */
-interface ServiceLogger {
-    debug(message: string): void;
-    info(message: string): void;
-    warn(message: string): void;
-}
-/**
- * A ready-to-use LSP facade for one project root (C.12): it owns the registry,
- * pool, and client, exposes the four normalized queries, and shuts the whole
- * server pool down on `close()`. Build one with {@link getLspService}, cached
- * per cwd so servers are spawned at most once per project per process.
- */
-export interface LspService {
-    definition(file: string, line: number, col: number): Promise<LspLocation[]>;
-    references(file: string, line: number, col: number): Promise<LspLocation[]>;
-    hover(file: string, line: number, col: number): Promise<LspHover | null>;
-    diagnostics(file: string): Promise<LspDiagnostic[]>;
-    /** Shut down every managed server (session end / process teardown). */
-    close(): Promise<void>;
-}
-/**
- * Explicit dependency overrides, for tests only. Production callers (the LSP
- * tools) never pass these, so they always go through the real stdio transport
- * and PATH-based binary detection.
- */
-export interface LspServiceDeps {
-    /** Substitute the JSON-RPC transport (a fake stdio peer — no real binary). */
-    transportFactory?: TransportFactory;
-    /** Substitute PATH-based binary detection (force present/absent). */
-    binaryPresent?: BinaryPresent;
-    /** Substitute the idle clock. */
-    now?: () => number;
-}
-/**
- * Get (or build) the {@link LspService} for a project root, cached per resolved
- * cwd so the pool is created at most once per process. No server spawns until
- * the first query. `deps` is for explicit test injection only.
- */
-export declare function getLspService(cwd: string, config: CruxyConfig, logger: ServiceLogger, deps?: LspServiceDeps): LspService;
-/** Drop all cached services (shutting them down). For tests and process teardown. */
-export declare function resetLspServices(): Promise<void>;
-export {};

package/dist/lsp/tools/common.d.ts

@@ -1,50 +0,0 @@
-import type { ToolContext, ToolResult } from "../../tools/types.js";
-import type { DeclaredRoot } from "../../workspace/index.js";
-import { type LspService } from "../service.js";
-import type { LspLocation } from "../types.js";
-/**
- * The root a query ran against, threaded to the tool so it can label locations by
- * their source root and — for references — name the per-root limitation (C.26).
- */
-export interface LspRootContext {
-    /** The declared root whose language-server pool answered the query. */
-    root: DeclaredRoot;
-    /** Whether this is a genuine multi-root session (labels render only then). */
-    isMultiRoot: boolean;
-}
-/**
- * The shared spine of every LSP tool (C.12): enforce the master switch, resolve
- * the target file to the ONE declared root that contains it, prove it exists, get
- * THAT root's language-server pool, and run `query`. Read-only throughout — no
- * `ctx.requestApproval`, so these bypass the U.3 gate exactly like `search_codebase`
- * and `grep_files`.
- *
- * Multi-repo (C.26, Funnel A→pool): the file is resolved through the shared
- * `resolveToolPath`, so it commits to exactly one root, and the pool is keyed by
- * THAT root's `absPath` (`getLspService` caches per resolved cwd → a per-root map
- * for free). A file in root B is answered by B's server, never A's — the
- * `(file → root)` selection and the `(root → pool)` key are the same value.
- *
- * Errors are surfaced as `{ ok:false }` text the agent can act on: a coded LSP
- * failure (no server / timeout / crash) is rendered WITH its next step, so the
- * agent can reroute (e.g. to grep) or the user can install the server. A genuine
- * empty answer never reaches here as an error — `query` returns it as `ok:true`.
- */
-export declare function runLspTool(ctx: ToolContext, file: string, query: (service: LspService, absFile: string, rc: LspRootContext) => Promise<ToolResult>): Promise<ToolResult>;
-/**
- * A note stating that a per-root language server only sees its own root, so
- * references/definitions in sibling roots are NOT searched (⚖︎JC-7) — returned only
- * in a multi-root session, so a references list is never read as complete when it
- * silently could not span roots. Empty string in single-root (byte-identical).
- */
-export declare function crossRootNote(rc: LspRootContext): string;
-/**
- * Render up to `max` locations as `path:line:col-endLine:endCol`, one per line,
- * with a trailing "N more" note when capped — the same bounded-honest pattern as
- * grep_files and search_codebase (never silently drop the overflow). In a
- * multi-root session each path is labelled `‹root› ▸ path` (the query ran against
- * one root, so every location carries that root's label).
- */
-export declare function formatLocations(locations: LspLocation[], max: number, rc: LspRootContext): string;
-/** Relative label for a validated absolute path, for tool messages. */
-export declare function relLabel(cwd: string, absFile: string): string;

package/dist/lsp/tools/find-definition.d.ts

@@ -1,23 +0,0 @@
-import { z } from "zod";
-import type { Tool } from "../../tools/types.js";
-declare const parameters: z.ZodObject<{
-    file: z.ZodString;
-    line: z.ZodNumber;
-    column: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    file: string;
-    line: number;
-    column: number;
-}, {
-    file: string;
-    line: number;
-    column: number;
-}>;
-/**
- * LSP go-to-definition (C.12). Read-only — no approval, like search_codebase.
- * Returns the definition site(s) as `path:line:col-endLine:endCol`. A missing
- * language server is a coded, actionable error (distinct from "no definition
- * found", which is an honest empty result).
- */
-export declare const findDefinitionTool: Tool<typeof parameters>;
-export {};

package/dist/lsp/tools/find-references.d.ts

@@ -1,23 +0,0 @@
-import { z } from "zod";
-import type { Tool } from "../../tools/types.js";
-declare const parameters: z.ZodObject<{
-    file: z.ZodString;
-    line: z.ZodNumber;
-    column: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    file: string;
-    line: number;
-    column: number;
-}, {
-    file: string;
-    line: number;
-    column: number;
-}>;
-/**
- * LSP find-references (C.12). Read-only — no approval. Returns every use of the
- * symbol (declaration included) as `path:line:col-endLine:endCol`, capped to
- * `lsp.maxResults` with an "N more" note so a hot symbol can't flood the output.
- * A missing server is a coded error, distinct from an honest "no references".
- */
-export declare const findReferencesTool: Tool<typeof parameters>;
-export {};

package/dist/lsp/tools/get-diagnostics.d.ts

@@ -1,17 +0,0 @@
-import { z } from "zod";
-import type { Tool } from "../../tools/types.js";
-declare const parameters: z.ZodObject<{
-    file: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    file: string;
-}, {
-    file: string;
-}>;
-/**
- * LSP diagnostics (C.12): the language server's errors/warnings for a file.
- * Read-only — no approval. Returns each diagnostic as
- * `severity path:line:col message [source]`, capped to `lsp.maxResults`. A
- * missing server is a coded error; a clean file is an honest empty result.
- */
-export declare const getDiagnosticsTool: Tool<typeof parameters>;
-export {};

package/dist/lsp/tools/hover.d.ts

@@ -1,23 +0,0 @@
-import { z } from "zod";
-import type { Tool } from "../../tools/types.js";
-declare const parameters: z.ZodObject<{
-    file: z.ZodString;
-    line: z.ZodNumber;
-    column: z.ZodNumber;
-}, "strip", z.ZodTypeAny, {
-    file: string;
-    line: number;
-    column: number;
-}, {
-    file: string;
-    line: number;
-    column: number;
-}>;
-/**
- * LSP hover (C.12): type signature / documentation for the symbol at a position.
- * Read-only — no approval. Returns the server's hover text (markup flattened to
- * plain text). A missing server is a coded error; a symbol with no hover info is
- * an honest empty result.
- */
-export declare const hoverTool: Tool<typeof parameters>;
-export {};

package/dist/lsp/tools/index.d.ts

@@ -1,4 +0,0 @@
-export { findDefinitionTool } from "./find-definition.js";
-export { findReferencesTool } from "./find-references.js";
-export { getDiagnosticsTool } from "./get-diagnostics.js";
-export { hoverTool } from "./hover.js";

package/dist/lsp/transport.d.ts

@@ -1,39 +0,0 @@
-import { killTree, killTrackedTrees, trackedTreeCount } from "../utils/child-tree.js";
-import type { LspTransport, ServerSpec } from "./types.js";
-export { killTree };
-/** @deprecated Use the shared backstop; kept for LSP tests. */
-export declare const killTrackedServers: typeof killTrackedTrees;
-/** @deprecated Use the shared backstop; kept for LSP tests. */
-export declare const trackedServerCount: typeof trackedTreeCount;
-export declare class StdioTransport implements LspTransport {
-    private readonly child;
-    private nextId;
-    private readonly pending;
-    private readonly notificationHandlers;
-    private crashHandler;
-    /** stdout parse buffer (header + body may arrive across chunks). */
-    private buffer;
-    private disposed;
-    /** Deregisters this process from the process-exit kill-tree backstop. */
-    private readonly unregisterCleanup;
-    constructor(spec: ServerSpec, root: string);
-    request(method: string, params: unknown, timeoutMs: number): Promise<unknown>;
-    notify(method: string, params: unknown): void;
-    onNotification(method: string, handler: (params: unknown) => void): void;
-    onCrash(handler: (info: {
-        code: number | null;
-        signal: string | null;
-    }) => void): void;
-    dispose(force?: boolean): Promise<void>;
-    private send;
-    private onStdout;
-    private dispatch;
-    private onExit;
-    private onSpawnError;
-}
-/** A per-request timeout, distinguishable from an ordinary LSP error response. */
-export declare class TransportTimeoutError extends Error {
-    readonly method: string;
-    readonly timeoutMs: number;
-    constructor(method: string, timeoutMs: number);
-}

package/dist/lsp/types.d.ts

@@ -1,107 +0,0 @@
-import type { LspConfig } from "../config/index.js";
-/**
- * Per-language LSP integration (C.12) — the shared vocabulary. Results here are
- * NORMALIZED (1-based lines/columns, project-relative paths, plain severities):
- * the LSP wire format's 0-based positions and `file://` URIs are converted at
- * the edge (`server.ts`) so nothing downstream speaks raw LSP.
- */
-export type { LspConfig };
-/**
- * A source range, normalized to 1-based lines and columns (LSP is 0-based; we
- * add 1 at the boundary). `path` is project-relative for display.
- */
-export interface LspLocation {
-    /** Project-relative file path. */
-    path: string;
-    /** 1-based start line. */
-    startLine: number;
-    /** 1-based start column. */
-    startCol: number;
-    /** 1-based end line. */
-    endLine: number;
-    /** 1-based end column. */
-    endCol: number;
-}
-/** A normalized diagnostic (severity mapped off the LSP 1–4 integer scale). */
-export interface LspDiagnostic {
-    /** Project-relative file path. */
-    path: string;
-    /** Where the diagnostic applies (1-based). */
-    range: LspLocation;
-    severity: "error" | "warning" | "info" | "hint";
-    message: string;
-    /** The producing tool, when the server reports it (e.g. "tsc", "gopls"). */
-    source?: string;
-}
-/** A normalized hover result — markdown/markup flattened to plain text. */
-export interface LspHover {
-    contents: string;
-    /** The symbol range the hover describes, when the server reports it. */
-    range?: LspLocation;
-}
-/**
- * A single, initialized language server (≈ one live child process). Queries are
- * absolute-path in / normalized-out; the client relativizes paths against the
- * workspace root. A method resolving to `[]`/`null` is an honest "no result" —
- * unavailability is signalled by a thrown coded error from the pool, never here.
- */
-export interface LanguageServer {
-    readonly language: string;
-    /** True until the process exits (crash detection flips this to false). */
-    readonly alive: boolean;
-    definition(file: string, line: number, col: number): Promise<LspLocation[]>;
-    references(file: string, line: number, col: number): Promise<LspLocation[]>;
-    diagnostics(file: string): Promise<LspDiagnostic[]>;
-    hover(file: string, line: number, col: number): Promise<LspHover | null>;
-    /** LSP `shutdown` → `exit`, then force-kill the process group after a grace. */
-    shutdown(force?: boolean): Promise<void>;
-}
-/** How to launch one language's server, resolved from config ∪ the default table. */
-export interface ServerSpec {
-    language: string;
-    /** Executable name or absolute path. */
-    command: string;
-    /** Argument vector (e.g. `["--stdio"]`). */
-    args: string[];
-    /** Concrete install instruction, surfaced when the binary is missing. */
-    installHint?: string;
-}
-/**
- * The registry's answer for a language. Availability is EXPLICIT: an
- * unavailable server carries the reason so the caller raises a coded,
- * actionable error rather than silently returning nothing.
- */
-export type ServerResolution = {
-    available: true;
-    spec: ServerSpec;
-} | {
-    available: false;
-    language: string;
-    spec: ServerSpec | null;
-    reason: "no-spec" | "binary-missing";
-};
-/**
- * The one seam tests replace: a live JSON-RPC peer over the server's stdio. A
- * fake implementation lets the whole stack run with NO real language-server
- * binary (mirroring `RecordingRuntime` for the sandbox).
- */
-export interface LspTransport {
-    /** Send a request and await its response, rejecting after `timeoutMs`. */
-    request(method: string, params: unknown, timeoutMs: number): Promise<unknown>;
-    /** Fire-and-forget notification (no response expected). */
-    notify(method: string, params: unknown): void;
-    /** Register a handler for a server→client notification (e.g. diagnostics). */
-    onNotification(method: string, handler: (params: unknown) => void): void;
-    /** Register a one-shot crash callback (process exited unexpectedly). */
-    onCrash(handler: (info: {
-        code: number | null;
-        signal: string | null;
-    }) => void): void;
-    /** LSP graceful path already sent by the caller; drop the transport,
-     * force-killing the process group after the grace when `force` is set. */
-    dispose(force?: boolean): Promise<void>;
-}
-/** Builds a transport for a resolved spec, rooted at `root`. Injectable in tests. */
-export type TransportFactory = (spec: ServerSpec, root: string) => LspTransport;
-/** Predicate: is `command` runnable (on PATH, or an existing executable path)? */
-export type BinaryPresent = (command: string) => boolean;

package/dist/mcp/adapter.d.ts

@@ -1,44 +0,0 @@
-import type { Tool } from "../tools/types.js";
-import { type McpBounds } from "./bounds.js";
-import type { McpCallResult, RawMcpTool } from "./types.js";
-/**
- * THE SINGLE SEAM (C.27). `mcpToolsFrom` is the ONE and ONLY place an MCP server
- * becomes an agent {@link Tool}. Nothing else in the codebase constructs an
- * MCP-backed tool, so every security property is enforced here, by construction:
- *
- * - GATE. Every produced tool's `execute` calls `ctx.requestApproval({kind:"mcp",
- *   …})` BEFORE it ever calls the server. A rejection returns the feedback as the
- *   tool result and `tools/call` never fires. The action is classified
- *   `destructive` and the classifier never reads the server's `readOnlyHint`
- *   (which this adapter deliberately does not even forward) — a server cannot
- *   self-declare its tool safe. A session grant is keyed on the exact server+tool
- *   pair, so approving one tool never covers another.
- * - DEMARCATE + GAG. Both the advertised description and every result are wrapped
- *   as untrusted external data with upstream model names scrubbed
- *   ({@link demarcateDescription} / {@link demarcateResult}) — the model never
- *   sees a raw, un-boxed description or result.
- * - BOUNDS. The server's tool list is capped in count and per-tool size
- *   ({@link boundToolList}); overflow is truncated with a visible note, never a
- *   silent drop or an unbounded context blow-up.
- * - NON-PERSISTENCE. `execute` returns a plain {@link ToolResult}; it writes to
- *   no store. Results live only in the in-memory conversation (asserted by test).
- *
- * Trust is enforced UPSTREAM (the service never calls this until the server is
- * trusted), so reaching this function already means "the user accepted running
- * this server's code unsandboxed".
- */
-export interface McpToolSource {
-    /** The configured server id (the tool-name prefix and gate key). */
-    server: string;
-    /** Tools exactly as the server advertised them (untrusted). */
-    tools: readonly RawMcpTool[];
-    /** Invoke a tool on the server by its ORIGINAL name. Adapter-internal only. */
-    call(toolName: string, args: unknown): Promise<McpCallResult>;
-    /** Size/count caps for the advertised list. */
-    bounds: McpBounds;
-    /** Where the visible "N tools dropped" note is surfaced. */
-    logger?: {
-        warn(message: string): void;
-    };
-}
-export declare function mcpToolsFrom(source: McpToolSource): Tool[];

package/dist/mcp/bounds.d.ts

@@ -1,35 +0,0 @@
-import type { RawMcpTool } from "./types.js";
-/**
- * Tool-list bounds (C.27). A malicious or buggy MCP server can advertise
- * thousands of tools with enormous descriptions and schemas — a context-budget
- * DoS. So the list a server returns is bounded exactly like `find_references`'
- * output: capped in count and per-tool size, and every truncation is surfaced as
- * a VISIBLE note (never a silent drop, never an unbounded blow-up). The caps are
- * config-driven (`mcp.maxToolsPerServer` / `maxDescriptionChars` / `maxSchemaBytes`).
- */
-export interface McpBounds {
-    maxTools: number;
-    maxDescriptionChars: number;
-    maxSchemaBytes: number;
-}
-/** A single tool after bounding, carrying any truncation notes for the model. */
-export interface BoundedTool {
-    name: string;
-    description: string;
-    inputSchema: Record<string, unknown>;
-    /** Human notes about what was truncated on THIS tool (surfaced as data). */
-    notes: string[];
-}
-export interface BoundedToolList {
-    tools: BoundedTool[];
-    /** How many tools were dropped because the server exceeded the count cap. */
-    droppedCount: number;
-}
-/**
- * Apply the bounds to a raw `tools/list`. Over the count cap → keep the first N
- * (by advertised order) and report `droppedCount`. Per tool: an over-long
- * description is truncated with a marker; an over-size input schema is replaced
- * with a permissive `object` schema and a note (we never forward an unbounded
- * schema, but we also never claim the args are constrained when we dropped it).
- */
-export declare function boundToolList(tools: readonly RawMcpTool[], bounds: McpBounds): BoundedToolList;

package/dist/mcp/client.d.ts

@@ -1,19 +0,0 @@
-import type { McpCallResult, McpTransport, RawMcpTool } from "./types.js";
-export interface McpClientTimeouts {
-    /** `initialize` + `tools/list` budget (connect-time). */
-    startupTimeout: number;
-    /** Per `tools/call` budget. */
-    requestTimeout: number;
-}
-export declare class McpClient {
-    private readonly transport;
-    private readonly timeouts;
-    constructor(transport: McpTransport, timeouts: McpClientTimeouts);
-    /** Perform the MCP handshake: `initialize`, then the `initialized` notice. */
-    initialize(): Promise<void>;
-    /** List the server's tools. Malformed entries are dropped, not thrown on. */
-    listTools(): Promise<RawMcpTool[]>;
-    /** Call one tool. Normalizes content to flat text + the server's error flag. */
-    callTool(name: string, args: unknown): Promise<McpCallResult>;
-    dispose(force?: boolean): Promise<void>;
-}

package/dist/mcp/demarcate.d.ts

@@ -1,12 +0,0 @@
-/**
- * Wrap a server-advertised tool description as untrusted data for the model. The
- * description is one of MCP's most direct injection surfaces (it is fed to the
- * model as the tool's own `description`), so it gets the same envelope as results.
- */
-export declare function demarcateDescription(server: string, tool: string, rawDescription: string): string;
-/**
- * Wrap a tool-call result as untrusted data for the model. Same discipline as
- * the description: the result is external content that may attempt injection, so
- * it is scrubbed, fence-neutralized, and clearly boxed as data.
- */
-export declare function demarcateResult(server: string, tool: string, rawResult: string): string;

package/dist/mcp/http-transport.d.ts

@@ -1,89 +0,0 @@
-import { fetch as undiciFetch } from "undici";
-import type { McpTransport } from "./types.js";
-/**
- * JSON-RPC 2.0 over MCP's Streamable HTTP transport (C.27b) — the network sibling
- * of {@link ../mcp/transport McpStdioTransport}. It satisfies the SAME
- * {@link McpTransport} seam, so `McpClient`, the single adapter (`mcpToolsFrom`),
- * bounds, demarcation, gating, and non-persistence are all inherited UNCHANGED —
- * every C.27 security property holds over the wire by construction, and all the
- * network-specific hardening lives here, below the seam.
- *
- * Trust boundary (this is a remote endpoint, not a local process):
- * - PINNED CONNECTIONS. The connection is pinned (undici `Agent` + {@link pinnedLookup})
- *   to the exact address set the SSRF guard already validated at trust time. The
- *   transport itself does NO DNS resolution — it dials only the passed addresses,
- *   so a DNS rebind cannot flip check→connect. The Host header / TLS SNI still
- *   carry the original hostname, so certificate hostname validation is unaffected.
- * - HTTPS + CERT VALIDATION. TLS validation is undici's default and is NEVER
- *   disabled — there is deliberately no skip-verify path (JC-E). `https` vs
- *   loopback-`http` is enforced upstream by the url-guard.
- * - NO REDIRECTS. `maxRedirections: 0` and a manual 3xx check: an MCP RPC endpoint
- *   has no legitimate reason to redirect, so a redirect is REFUSED (never re-pinned
- *   and followed to a new, unvalidated host).
- * - NO SOCKET BEFORE TRUST (JC-C). The constructor opens no socket and resolves no
- *   DNS; the first network I/O is the `initialize` POST, which the service issues
- *   only after the trust gate passes.
- *
- * Inbound posture mirrors stdio: cruxy advertises NO capabilities (no sampling, no
- * roots, no elicitation), so it never solicits server→client requests; any that
- * arrive on a response stream are ignored, never acted on. This is a deliberate
- * SUBSET of Streamable HTTP — no standalone GET listening stream and no SSE
- * resumption — sufficient for request/response tool use and easy to reason about.
- */
-export interface McpHttpSpec {
-    /** The server endpoint (already scheme/SSRF-validated by the url-guard). */
-    url: string;
-    /** Pre-validated address set to pin the connection to (never re-resolved here). */
-    addresses: string[];
-    /** `initialize` + `tools/list` budget, ms. */
-    connectTimeout: number;
-    /** Per `tools/call` budget, ms. */
-    requestTimeout: number;
-    /**
-     * Resolved auth headers (C.27c), attached to every request to THIS pinned,
-     * https endpoint (never on a redirect target, never over http). Empty/absent for
-     * an unauthenticated server. Reserved framing headers here are ignored — a
-     * credential can never rewrite content-type/accept/session framing.
-     */
-    authHeaders?: Record<string, string>;
-}
-/**
- * The endpoint rejected our credential (401/403) — C.27c. A DISTINCT type so the
- * service maps it to `CRUXY_E_MCP_AUTH` ("credential rejected") rather than the
- * generic connect failure. Carries only the status; the token never touches it.
- */
-export declare class McpHttpAuthError extends Error {
-    readonly status: number;
-    constructor(status: number);
-}
-/** Minimal fetch surface we depend on (injectable for tests). */
-type FetchLike = typeof undiciFetch;
-export declare class McpHttpTransport implements McpTransport {
-    private readonly url;
-    private readonly connectTimeout;
-    private readonly requestTimeout;
-    private readonly dispatcher;
-    private readonly fetchImpl;
-    /** Sanitized auth headers, sent ONLY over https to this pinned endpoint. */
-    private readonly authHeaders;
-    private nextId;
-    private disposed;
-    /** Streamable HTTP session id, captured from the `initialize` response. */
-    private sessionId;
-    private crashHandler;
-    /** In-flight request aborts, so `dispose()` can cancel them. */
-    private readonly inflight;
-    constructor(spec: McpHttpSpec, fetchImpl?: FetchLike);
-    /** Whether the `initialize` handshake budget or the per-call budget applies. */
-    private budgetFor;
-    request(method: string, params: unknown, timeoutMs: number): Promise<unknown>;
-    notify(method: string, params: unknown): void;
-    onCrash(handler: (info: {
-        code: number | null;
-        signal: string | null;
-    }) => void): void;
-    dispose(): Promise<void>;
-    /** POST one framed JSON-RPC message; refuse redirects; reject non-2xx. */
-    private post;
-}
-export {};

package/dist/mcp/index.d.ts

@@ -1,12 +0,0 @@
-export type { McpTrust, McpTransport, RawMcpTool, McpCallResult, } from "./types.js";
-export { mcpTrustPath, fingerprintMcpServers, isMcpTrusted, endpointsMatch, fileMcpTrustStore, memoryMcpTrustStore, type McpTrustStore, } from "./trust.js";
-export { ensureMcpTrust, type EnsureMcpTrustDeps, type EnsureMcpTrustResult, type McpTrustIO, type McpTrustOutcome, } from "./trust-gate.js";
-export { validateMcpUrl, resolveMcpEndpoints, type ValidatedMcpUrl, } from "./url-guard.js";
-export { McpHttpTransport, McpHttpAuthError, type McpHttpSpec, } from "./http-transport.js";
-export { demarcateDescription, demarcateResult } from "./demarcate.js";
-export { boundToolList, type McpBounds, type BoundedTool, type BoundedToolList, } from "./bounds.js";
-export { McpStdioTransport, type McpSpawnSpec } from "./transport.js";
-export { McpClient, type McpClientTimeouts } from "./client.js";
-export { mcpToolsFrom, type McpToolSource } from "./adapter.js";
-export { deferredSiblingServers, type DeferredSiblingServer, } from "./sibling-banner.js";
-export { connectMcpTools, resetMcpServices, liveMcpConnectionCount, type ConnectMcpToolsParams, type ConnectMcpToolsResult, type McpServiceDeps, } from "./service.js";

package/dist/mcp/service.d.ts

@@ -1,71 +0,0 @@
-import type { CruxyConfig, McpServerConfig } from "../config/index.js";
-import type { HostResolver } from "../net/ip-guard.js";
-import type { Tool } from "../tools/types.js";
-import { type McpTrustStore } from "./trust.js";
-import { type McpTrustIO } from "./trust-gate.js";
-import type { McpTransport } from "./types.js";
-/**
- * The session-facing MCP entry point (C.27). `connectMcpTools` is what a session
- * calls at start to (1) honor the master switch, (2) enforce the connect-time
- * trust gate, and (3) connect every trusted server and return its gated tools —
- * all produced through the single adapter seam. Connections are tracked so
- * {@link resetMcpServices} can shut them down at session end (the shared
- * child-tree exit backstop is the fail-safe for a hard kill).
- *
- * Off-by-default is enforced first: when `mcp.enabled` is false, this returns no
- * tools without ever reading trust, spawning a process, or touching a server.
- */
-interface ServiceLogger {
-    debug(message: string): void;
-    info(message: string): void;
-    warn(message: string): void;
-}
-/** Explicit dependency overrides, for tests only. Production passes none. */
-export interface McpServiceDeps {
-    /** Substitute the transport (a fake peer — no real server binary/socket). */
-    transportFactory?: (server: string, cfg: McpServerConfig, root: string, 
-    /** Pre-validated, pinned address set (url servers only). */
-    addresses: string[], 
-    /** Resolved auth headers (url servers only; C.27c). */
-    authHeaders?: Record<string, string>) => McpTransport;
-    /** Substitute the trust store. */
-    trustStore?: McpTrustStore;
-    /** ISO-timestamp source for a recorded trust decision. */
-    now?: () => string;
-    /** DNS resolver for the trust gate's url-endpoint capture + SSRF guard. */
-    resolveHost?: HostResolver;
-}
-export interface ConnectMcpToolsParams {
-    cwd: string;
-    config: CruxyConfig;
-    logger: ServiceLogger;
-    /** Whether cruxy can prompt for trust (stdin is a TTY). */
-    interactive: boolean;
-    /** Prompt I/O for the trust disclosure (required to prompt when interactive). */
-    io?: McpTrustIO;
-    deps?: McpServiceDeps;
-}
-export interface ConnectMcpToolsResult {
-    /** The gated MCP tools to register (empty when disabled / untrusted-declined). */
-    tools: Tool[];
-}
-export declare function connectMcpTools(params: ConnectMcpToolsParams): Promise<ConnectMcpToolsResult>;
-/**
- * Resolve the auth headers to send to a `url` server (C.27c), or `undefined` for
- * an unauthenticated/stdio server. Two sources, both user-owned and outside the
- * repo: a `credentialRef` looked up SOLELY in `~/.cruxy/credentials.json` (never
- * the env, never any config file), and raw `headers` (accepted only from
- * user-scope config — the loader already rejected them from project scope). A
- * named credential with no stored token throws {@link mcpAuth} (missing) so a
- * dangling reference fails cleanly rather than connecting unauthenticated.
- */
-export declare function resolveMcpAuthHeaders(server: string, cfg: McpServerConfig, read?: (ref: string) => string | undefined): Record<string, string> | undefined;
-/**
- * Dispose every live MCP connection (session end / process teardown). Mirrors
- * `resetLspServices`; the shared child-tree exit backstop reaps anything a hard
- * kill skips. Idempotent.
- */
-export declare function resetMcpServices(): Promise<void>;
-/** Number of live MCP connections (for tests). */
-export declare function liveMcpConnectionCount(): number;
-export {};

package/dist/mcp/sibling-banner.d.ts

@@ -1,25 +0,0 @@
-import type { Workspace } from "../workspace/index.js";
-/**
- * MCP is PRIMARY-ROOT ONLY this release (JC-D). Two roots each declaring a
- * `github` server would collide on the wire-name `mcp__github__<tool>` (the
- * adapter derives it from the server id with no root component), so sibling-root
- * servers are NOT registered. They are also NOT silently dropped: each one is
- * named individually in the startup banner (server + which root declared it), so
- * the deferral is explicit. Root-qualified wire-names are a separate follow-up.
- */
-export interface DeferredSiblingServer {
-    /** The declared server id (the would-be `mcp__<server>__*` prefix). */
-    server: string;
-    /** The declaring non-primary root's name. */
-    root: string;
-}
-/**
- * Enumerate the MCP servers declared by each NON-primary root's own project
- * config — the set deferred this release. Pure over an injectable reader so the
- * naming is unit-testable without touching disk. Reads each sibling's OWN
- * declaration (not the merged/global set), so a sibling's `github` is named even
- * when the primary also declares one (the exact collision we're deferring).
- */
-export declare function deferredSiblingServers(workspace: Workspace, opts?: {
-    declaredServersFor?: (absPath: string) => string[];
-}): DeferredSiblingServer[];