@cuna_labs/cli 0.1.0

package/dist/local-actions/private-port-forward.js

@@ -0,0 +1,154 @@
+import { createServer, createConnection } from "node:net";
+import { assertLoopbackHost, assertPort, isLoopbackPeer } from "./loopback.js";
+export class PrivatePortForwardError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "PrivatePortForwardError";
+    }
+}
+export async function startPrivatePortForward(options) {
+    validateOptions(options);
+    const now = options.now ?? Date.now;
+    if (isAborted(options.signal))
+        throw new PrivatePortForwardError("cancelled", "Private port forward was cancelled before it started.");
+    if (now() >= options.deadlineMs)
+        throw new PrivatePortForwardError("expired", "Private port forward deadline elapsed.");
+    const connector = options.connector ?? {
+        connect: (target) => createConnection({ host: target.host, port: target.port }),
+    };
+    const sockets = new Set();
+    let activeConnections = 0;
+    let bytes = 0;
+    let closing;
+    let resolveClosed;
+    const closed = new Promise((resolve) => { resolveClosed = resolve; });
+    const server = createServer((local) => {
+        if (!isLoopbackPeer(local.remoteAddress) || activeConnections >= options.maximumConnections) {
+            local.destroy();
+            return;
+        }
+        activeConnections += 1;
+        sockets.add(local);
+        let remote;
+        try {
+            remote = connector.connect(Object.freeze({ host: options.remoteHost, port: options.remotePort }));
+        }
+        catch {
+            local.destroy();
+            activeConnections -= 1;
+            sockets.delete(local);
+            return;
+        }
+        sockets.add(remote);
+        let connectionClosed = false;
+        const finishConnection = () => {
+            if (connectionClosed)
+                return;
+            connectionClosed = true;
+            activeConnections -= 1;
+            sockets.delete(local);
+            sockets.delete(remote);
+            local.destroy();
+            remote.destroy();
+        };
+        const account = (chunk) => {
+            bytes += chunk.byteLength;
+            if (bytes > options.maximumBytes)
+                void close();
+        };
+        local.on("data", account);
+        remote.on("data", account);
+        local.once("error", finishConnection);
+        remote.once("error", finishConnection);
+        local.once("close", finishConnection);
+        remote.once("close", finishConnection);
+        local.pipe(remote);
+        remote.pipe(local);
+    });
+    server.on("connection", (socket) => {
+        if (!isLoopbackPeer(socket.remoteAddress))
+            socket.destroy();
+    });
+    let deadlineTimer;
+    let abortRegistered = false;
+    const abortListener = () => { void close(); };
+    async function close() {
+        if (closing !== undefined)
+            return closing;
+        closing = (async () => {
+            if (deadlineTimer !== undefined)
+                clearTimeout(deadlineTimer);
+            if (abortRegistered)
+                options.signal?.removeEventListener("abort", abortListener);
+            await closeAll(server, sockets);
+            resolveClosed();
+        })();
+        return closing;
+    }
+    try {
+        await listen(server, options.requestedLocalPort, options.localHost);
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+    const address = server.address();
+    if (address === null || typeof address === "string") {
+        await close();
+        throw new PrivatePortForwardError("bind_failed", "Private port forward did not bind a TCP address.");
+    }
+    if (isAborted(options.signal) || now() >= options.deadlineMs) {
+        await close();
+        throw new PrivatePortForwardError(isAborted(options.signal) ? "cancelled" : "expired", "Private port forward authority ended while binding.");
+    }
+    deadlineTimer = setTimeout(() => { void close(); }, Math.max(1, options.deadlineMs - now()));
+    deadlineTimer.unref();
+    options.signal?.addEventListener("abort", abortListener, { once: true });
+    abortRegistered = options.signal !== undefined;
+    return Object.freeze({
+        localHost: options.localHost,
+        localPort: address.port,
+        remoteHost: options.remoteHost,
+        remotePort: options.remotePort,
+        closed,
+        transferredBytes: () => bytes,
+        close,
+    });
+}
+function validateOptions(options) {
+    assertLoopbackHost(options.localHost, "Private forward local host");
+    assertPort(options.requestedLocalPort, "Private forward local port", true);
+    assertLoopbackHost(options.remoteHost, "Private forward remote host");
+    assertPort(options.remotePort, "Private forward remote port");
+    if (!Number.isSafeInteger(options.deadlineMs) || !Number.isSafeInteger(options.maximumConnections) ||
+        options.maximumConnections < 1 || options.maximumConnections > 128 || !Number.isSafeInteger(options.maximumBytes) ||
+        options.maximumBytes < 1 || options.maximumBytes > 1_073_741_824) {
+        throw new TypeError("Private port forward bounds are invalid.");
+    }
+}
+function listen(server, port, host) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => { server.off("listening", onListening); reject(error); };
+        const onListening = () => { server.off("error", onError); resolve(); };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen({ host, port, exclusive: true });
+    });
+}
+function closeAll(server, sockets) {
+    for (const socket of sockets)
+        socket.destroy();
+    return new Promise((resolve) => {
+        if (!server.listening) {
+            resolve();
+            return;
+        }
+        server.close(() => resolve());
+    });
+}
+function isAborted(signal) {
+    return signal?.aborted === true;
+}
+//# sourceMappingURL=private-port-forward.js.map

package/dist/local-actions/private-port-forward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-port-forward.js","sourceRoot":"","sources":["../../src/local-actions/private-port-forward.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAA4B,MAAM,UAAU,CAAC;AAEpF,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,cAAc,EAAqB,MAAM,eAAe,CAAC;AAkClG,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACb;IAAnC,YAAmC,IAAY,EAAE,OAAe;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAC;QADkB,SAAI,GAAJ,IAAI,CAAQ;QAE7C,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAkC;IAC9E,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,WAAW,EAAE,uDAAuD,CAAC,CAAC;IACvI,IAAI,GAAG,EAAE,IAAI,OAAO,CAAC,UAAU;QAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;IAExH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI;QACrC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;KAChF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAkC,CAAC;IACvC,IAAI,aAA0B,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,KAAK,EAAE,EAAE;QACpC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC5F,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QACD,iBAAiB,IAAI,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,iBAAiB,IAAI,CAAC,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,MAAM,gBAAgB,GAAG,GAAS,EAAE;YAClC,IAAI,gBAAgB;gBAAE,OAAO;YAC7B,gBAAgB,GAAG,IAAI,CAAC;YACxB,iBAAiB,IAAI,CAAC,CAAC;YACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvB,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAQ,EAAE;YACtC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,OAAO,CAAC,YAAY;gBAAE,KAAK,KAAK,EAAE,CAAC;QACjD,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;QACjC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,IAAI,aAAyC,CAAC;IAC9C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,MAAM,aAAa,GAAG,GAAS,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAEpD,KAAK,UAAU,KAAK;QAClB,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAC1C,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,IAAI,aAAa,KAAK,SAAS;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC7D,IAAI,eAAe;gBAAE,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACjF,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,aAAa,EAAE,CAAC;QAClB,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,kBAAkB,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,uBAAuB,CAAC,aAAa,EAAE,kDAAkD,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC7D,MAAM,KAAK,EAAE,CAAC;QACd,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,qDAAqD,CAAC,CAAC;IAChJ,CAAC;IACD,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7F,aAAa,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,eAAe,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC;IAE/C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,IAAI;QACvB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM;QACN,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK;QAC7B,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,OAAkC;IACzD,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;IACpE,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,4BAA4B,EAAE,IAAI,CAAC,CAAC;IAC3E,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IACtE,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAChG,OAAO,CAAC,kBAAkB,GAAG,CAAC,IAAI,OAAO,CAAC,kBAAkB,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,CAAC;QACjH,OAAO,CAAC,YAAY,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,GAAG,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,IAAkB;IAC9D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,WAAW,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,OAA4B;IAC5D,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,MAA+B;IAChD,OAAO,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;AAClC,CAAC"}

package/dist/local-actions/provider-mcp-config.d.ts

@@ -0,0 +1,101 @@
+import { type LocalActionProvider } from "./contracts.js";
+export declare const CUNA_AGENT_SESSION_MCP_SERVER: "cuna_local_actions";
+export declare const CUNA_AGENT_SESSION_MCP_COMMAND: "cuna-agent-session-mcp";
+export interface RemoteMcpSessionBinding {
+    readonly agentSessionId: string;
+    readonly processEpoch: string;
+    readonly attachmentGeneration: number;
+    /**
+     * Private, per-AgentSession Unix socket inside the remote VM. The local CLI
+     * never opens this path and the provider never receives a network endpoint.
+     */
+    readonly privateSocketPath: string;
+    /**
+     * Opaque, non-exportable reference understood only by the supervisor. This
+     * is not an access token or provider credential.
+     */
+    readonly capabilityReference: string;
+}
+export interface EphemeralMcpConfigTarget {
+    /** Provider-visible path owned by the current AgentSession runtime. */
+    readonly path: string;
+    readonly exclusiveCreate: true;
+    readonly mode: 0o600;
+    readonly lifetime: "provider_process";
+}
+export interface EphemeralMcpCleanupContract {
+    readonly required: true;
+    readonly triggers: readonly ["provider_exit", "attach_cancelled", "identity_changed"];
+    readonly targets: readonly string[];
+    readonly completion: "absence_verified";
+}
+interface McpStdioServerConfiguration {
+    readonly command: typeof CUNA_AGENT_SESSION_MCP_COMMAND;
+    readonly args: readonly string[];
+    readonly env: Readonly<Record<string, string>>;
+}
+export interface ClaudeMcpLaunchPlan {
+    readonly provider: "claude-code";
+    readonly enabled: true;
+    readonly format: "claude_mcp_json";
+    readonly config: Readonly<{
+        mcpServers: Readonly<Record<typeof CUNA_AGENT_SESSION_MCP_SERVER, Readonly<McpStdioServerConfiguration & {
+            readonly type: "stdio";
+        }>>>;
+    }>;
+    readonly serializedConfig: string;
+    readonly argvSuffix: readonly ["--mcp-config", string, "--strict-mcp-config"];
+    readonly target: EphemeralMcpConfigTarget;
+    readonly cleanup: EphemeralMcpCleanupContract;
+}
+export interface CodexMcpLaunchPlan {
+    readonly provider: "codex";
+    readonly enabled: true;
+    readonly format: "codex_toml_overlay";
+    readonly config: Readonly<{
+        mcp_servers: Readonly<Record<typeof CUNA_AGENT_SESSION_MCP_SERVER, Readonly<McpStdioServerConfiguration & {
+            readonly enabled: true;
+            readonly startup_timeout_sec: 10;
+            readonly tool_timeout_sec: 300;
+        }>>>;
+    }>;
+    readonly serializedConfig: string;
+    /** Repeatable Codex `-c key=value` overlays; no global config is mutated. */
+    readonly argvSuffix: readonly string[];
+    readonly target: EphemeralMcpConfigTarget;
+    readonly cleanup: EphemeralMcpCleanupContract;
+}
+export interface OpenCodeMcpLaunchPlan {
+    readonly provider: "opencode";
+    readonly enabled: true;
+    readonly format: "opencode_local_mcp";
+    readonly config: Readonly<{
+        readonly $schema: "https://opencode.ai/config.json";
+        readonly mcp: Readonly<Record<typeof CUNA_AGENT_SESSION_MCP_SERVER, Readonly<{
+            readonly type: "local";
+            readonly command: readonly string[];
+            readonly enabled: true;
+            readonly environment: Readonly<Record<string, string>>;
+        }>>>;
+    }>;
+    readonly serializedConfig: string;
+    readonly argvSuffix: readonly [];
+    /** OpenCode loads the process-scoped overlay from this exact file. */
+    readonly environment: Readonly<{
+        readonly OPENCODE_CONFIG: string;
+    }>;
+    readonly target: EphemeralMcpConfigTarget;
+    readonly cleanup: EphemeralMcpCleanupContract;
+}
+export type ProviderMcpLaunchPlan = ClaudeMcpLaunchPlan | CodexMcpLaunchPlan | OpenCodeMcpLaunchPlan;
+export declare class ProviderMcpConfigurationError extends Error {
+    readonly name = "ProviderMcpConfigurationError";
+}
+export declare function buildClaudeMcpLaunchPlan(binding: RemoteMcpSessionBinding, target: EphemeralMcpConfigTarget): ClaudeMcpLaunchPlan;
+export declare function buildCodexMcpLaunchPlan(binding: RemoteMcpSessionBinding, target: EphemeralMcpConfigTarget): CodexMcpLaunchPlan;
+export declare function buildOpenCodeMcpLaunchPlan(binding: RemoteMcpSessionBinding, target: EphemeralMcpConfigTarget): OpenCodeMcpLaunchPlan;
+/** @deprecated Use buildOpenCodeMcpLaunchPlan with an exact fenced binding. */
+export declare const describeOpenCodeMcpContract: typeof buildOpenCodeMcpLaunchPlan;
+export declare function buildProviderMcpLaunchPlan(provider: LocalActionProvider, binding: RemoteMcpSessionBinding, target: EphemeralMcpConfigTarget): ProviderMcpLaunchPlan;
+export {};
+//# sourceMappingURL=provider-mcp-config.d.ts.map

package/dist/local-actions/provider-mcp-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-mcp-config.d.ts","sourceRoot":"","sources":["../../src/local-actions/provider-mcp-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiC,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEzF,eAAO,MAAM,6BAA6B,EAAG,oBAA6B,CAAC;AAC3E,eAAO,MAAM,8BAA8B,EAAG,wBAAiC,CAAC;AAKhF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,wBAAwB;IACvC,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IACtF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;CACzC;AAED,UAAU,2BAA2B;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,8BAA8B,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;QACxB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,6BAA6B,EAAE,QAAQ,CAAC,2BAA2B,GAAG;YAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC,CAAC,CAAC;KACxI,CAAC,CAAC;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC9E,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;CAC/C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;QACxB,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,6BAA6B,EAAE,QAAQ,CAAC,2BAA2B,GAAG;YACxG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;YACvB,QAAQ,CAAC,mBAAmB,EAAE,EAAE,CAAC;YACjC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAChC,CAAC,CAAC,CAAC,CAAC;KACN,CAAC,CAAC;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC;QACpD,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,6BAA6B,EAAE,QAAQ,CAAC;YAC3E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;YACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YACpC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;YACvB,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SACxD,CAAC,CAAC,CAAC,CAAC;KACN,CAAC,CAAC;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;QAAE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;CAC/C;AAED,MAAM,MAAM,qBAAqB,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,qBAAqB,CAAC;AAErG,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,SAAkB,IAAI,mCAAmC;CAC1D;AA6ED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,mBAAmB,CAgBrB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,kBAAkB,CA0CpB;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,qBAAqB,CAwBvB;AAED,+EAA+E;AAC/E,eAAO,MAAM,2BAA2B,mCAA6B,CAAC;AAEtE,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,qBAAqB,CAIvB"}

package/dist/local-actions/provider-mcp-config.js

@@ -0,0 +1,166 @@
+import { LOCAL_ACTION_PROTOCOL_VERSION } from "./contracts.js";
+export const CUNA_AGENT_SESSION_MCP_SERVER = "cuna_local_actions";
+export const CUNA_AGENT_SESSION_MCP_COMMAND = "cuna-agent-session-mcp";
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u;
+const UNIX_SOCKET = /^\/(?:[^/]+\/)*[^/]+$/u;
+export class ProviderMcpConfigurationError extends Error {
+    name = "ProviderMcpConfigurationError";
+}
+function assertOpaqueIdentifier(value, label) {
+    if (!IDENTIFIER.test(value)) {
+        throw new ProviderMcpConfigurationError(`${label} must be an opaque identifier without whitespace or control characters.`);
+    }
+}
+function validateBinding(binding) {
+    assertOpaqueIdentifier(binding.agentSessionId, "agentSessionId");
+    assertOpaqueIdentifier(binding.processEpoch, "processEpoch");
+    assertOpaqueIdentifier(binding.capabilityReference, "capabilityReference");
+    if (!Number.isSafeInteger(binding.attachmentGeneration) || binding.attachmentGeneration < 0) {
+        throw new ProviderMcpConfigurationError("attachmentGeneration must be a non-negative safe integer.");
+    }
+    if (binding.privateSocketPath.length > 512 ||
+        hasControlCharacters(binding.privateSocketPath) ||
+        !UNIX_SOCKET.test(binding.privateSocketPath)) {
+        throw new ProviderMcpConfigurationError("privateSocketPath must be an absolute Unix socket path without control characters.");
+    }
+}
+function validateTarget(target) {
+    if (target.path.length === 0 ||
+        target.path.length > 1_024 ||
+        hasControlCharacters(target.path)) {
+        throw new ProviderMcpConfigurationError("The ephemeral MCP config path is invalid.");
+    }
+    if (target.exclusiveCreate !== true || target.mode !== 0o600 || target.lifetime !== "provider_process") {
+        throw new ProviderMcpConfigurationError("The MCP config target must be exclusive, mode 0600, and provider-process scoped.");
+    }
+}
+function hasControlCharacters(value) {
+    return [...value].some((character) => {
+        const point = character.codePointAt(0) ?? 0;
+        return point <= 31 || point === 127;
+    });
+}
+function remoteServer(binding) {
+    validateBinding(binding);
+    return Object.freeze({
+        command: CUNA_AGENT_SESSION_MCP_COMMAND,
+        args: Object.freeze([
+            "--transport", "unix",
+            "--socket", binding.privateSocketPath,
+            "--agent-session", binding.agentSessionId,
+            "--process-epoch", binding.processEpoch,
+            "--attachment-generation", String(binding.attachmentGeneration),
+            "--capability-ref", binding.capabilityReference,
+        ]),
+        env: Object.freeze({ CUNA_LOCAL_ACTION_PROTOCOL: String(LOCAL_ACTION_PROTOCOL_VERSION) }),
+    });
+}
+function cleanupFor(target) {
+    return Object.freeze({
+        required: true,
+        triggers: Object.freeze(["provider_exit", "attach_cancelled", "identity_changed"]),
+        targets: Object.freeze([target.path]),
+        completion: "absence_verified",
+    });
+}
+function tomlString(value) {
+    return JSON.stringify(value);
+}
+function tomlStringArray(values) {
+    return `[${values.map(tomlString).join(", ")}]`;
+}
+export function buildClaudeMcpLaunchPlan(binding, target) {
+    validateTarget(target);
+    const server = Object.freeze({ ...remoteServer(binding), type: "stdio" });
+    const config = Object.freeze({
+        mcpServers: Object.freeze({ [CUNA_AGENT_SESSION_MCP_SERVER]: server }),
+    });
+    return Object.freeze({
+        provider: "claude-code",
+        enabled: true,
+        format: "claude_mcp_json",
+        config,
+        serializedConfig: `${JSON.stringify(config)}\n`,
+        argvSuffix: Object.freeze(["--mcp-config", target.path, "--strict-mcp-config"]),
+        target,
+        cleanup: cleanupFor(target),
+    });
+}
+export function buildCodexMcpLaunchPlan(binding, target) {
+    validateTarget(target);
+    const base = remoteServer(binding);
+    const server = Object.freeze({
+        ...base,
+        enabled: true,
+        startup_timeout_sec: 10,
+        tool_timeout_sec: 300,
+    });
+    const config = Object.freeze({
+        mcp_servers: Object.freeze({ [CUNA_AGENT_SESSION_MCP_SERVER]: server }),
+    });
+    const section = `[mcp_servers.${CUNA_AGENT_SESSION_MCP_SERVER}]`;
+    const env = `{ CUNA_LOCAL_ACTION_PROTOCOL = ${tomlString(String(LOCAL_ACTION_PROTOCOL_VERSION))} }`;
+    const serializedConfig = [
+        section,
+        `command = ${tomlString(server.command)}`,
+        `args = ${tomlStringArray(server.args)}`,
+        "enabled = true",
+        `startup_timeout_sec = ${server.startup_timeout_sec}`,
+        `tool_timeout_sec = ${server.tool_timeout_sec}`,
+        `env = ${env}`,
+        "",
+    ].join("\n");
+    const argvSuffix = Object.freeze([
+        "-c", `mcp_servers.${CUNA_AGENT_SESSION_MCP_SERVER}.command=${tomlString(server.command)}`,
+        "-c", `mcp_servers.${CUNA_AGENT_SESSION_MCP_SERVER}.args=${tomlStringArray(server.args)}`,
+        "-c", `mcp_servers.${CUNA_AGENT_SESSION_MCP_SERVER}.enabled=true`,
+        "-c", `mcp_servers.${CUNA_AGENT_SESSION_MCP_SERVER}.startup_timeout_sec=${server.startup_timeout_sec}`,
+        "-c", `mcp_servers.${CUNA_AGENT_SESSION_MCP_SERVER}.tool_timeout_sec=${server.tool_timeout_sec}`,
+        "-c", `mcp_servers.${CUNA_AGENT_SESSION_MCP_SERVER}.env=${env}`,
+    ]);
+    return Object.freeze({
+        provider: "codex",
+        enabled: true,
+        format: "codex_toml_overlay",
+        config,
+        serializedConfig,
+        argvSuffix,
+        target,
+        cleanup: cleanupFor(target),
+    });
+}
+export function buildOpenCodeMcpLaunchPlan(binding, target) {
+    validateTarget(target);
+    const base = remoteServer(binding);
+    const server = Object.freeze({
+        type: "local",
+        command: Object.freeze([base.command, ...base.args]),
+        enabled: true,
+        environment: base.env,
+    });
+    const config = Object.freeze({
+        $schema: "https://opencode.ai/config.json",
+        mcp: Object.freeze({ [CUNA_AGENT_SESSION_MCP_SERVER]: server }),
+    });
+    return Object.freeze({
+        provider: "opencode",
+        enabled: true,
+        format: "opencode_local_mcp",
+        config,
+        serializedConfig: `${JSON.stringify(config)}\n`,
+        argvSuffix: Object.freeze([]),
+        environment: Object.freeze({ OPENCODE_CONFIG: target.path }),
+        target,
+        cleanup: cleanupFor(target),
+    });
+}
+/** @deprecated Use buildOpenCodeMcpLaunchPlan with an exact fenced binding. */
+export const describeOpenCodeMcpContract = buildOpenCodeMcpLaunchPlan;
+export function buildProviderMcpLaunchPlan(provider, binding, target) {
+    if (provider === "claude-code")
+        return buildClaudeMcpLaunchPlan(binding, target);
+    if (provider === "codex")
+        return buildCodexMcpLaunchPlan(binding, target);
+    return buildOpenCodeMcpLaunchPlan(binding, target);
+}
+//# sourceMappingURL=provider-mcp-config.js.map

package/dist/local-actions/provider-mcp-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-mcp-config.js","sourceRoot":"","sources":["../../src/local-actions/provider-mcp-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAA4B,MAAM,gBAAgB,CAAC;AAEzF,MAAM,CAAC,MAAM,6BAA6B,GAAG,oBAA6B,CAAC;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,wBAAiC,CAAC;AAEhF,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAC1D,MAAM,WAAW,GAAG,wBAAwB,CAAC;AA6F7C,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACpC,IAAI,GAAG,+BAA+B,CAAC;CAC1D;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,6BAA6B,CAAC,GAAG,KAAK,yEAAyE,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,OAAgC;IACvD,sBAAsB,CAAC,OAAO,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACjE,sBAAsB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAC7D,sBAAsB,CAAC,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,6BAA6B,CAAC,2DAA2D,CAAC,CAAC;IACvG,CAAC;IACD,IACE,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,GAAG;QACtC,oBAAoB,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC/C,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAC5C,CAAC;QACD,MAAM,IAAI,6BAA6B,CAAC,oFAAoF,CAAC,CAAC;IAChI,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAgC;IACtD,IACE,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK;QAC1B,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,6BAA6B,CAAC,2CAA2C,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACvG,MAAM,IAAI,6BAA6B,CAAC,kFAAkF,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,KAAK,IAAI,EAAE,IAAI,KAAK,KAAK,GAAG,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,OAAgC;IACpD,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,aAAa,EAAE,MAAM;YACrB,UAAU,EAAE,OAAO,CAAC,iBAAiB;YACrC,iBAAiB,EAAE,OAAO,CAAC,cAAc;YACzC,iBAAiB,EAAE,OAAO,CAAC,YAAY;YACvC,yBAAyB,EAAE,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAC/D,kBAAkB,EAAE,OAAO,CAAC,mBAAmB;SAChD,CAAC;QACF,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC;KAC1F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,MAAgC;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE,kBAAkB,EAAE,kBAAkB,CAAU,CAAC;QAC3F,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,UAAU,EAAE,kBAAkB;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAgC,EAChC,MAAgC;IAEhC,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;KACvE,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,iBAAiB;QACzB,MAAM;QACN,gBAAgB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;QAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,qBAAqB,CAAU,CAAC;QACxF,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAgC,EAChC,MAAgC;IAEhC,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,GAAG,IAAI;QACP,OAAO,EAAE,IAAa;QACtB,mBAAmB,EAAE,EAAW;QAChC,gBAAgB,EAAE,GAAY;KAC/B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;KACxE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,gBAAgB,6BAA6B,GAAG,CAAC;IACjE,MAAM,GAAG,GAAG,kCAAkC,UAAU,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAAC;IACpG,MAAM,gBAAgB,GAAG;QACvB,OAAO;QACP,aAAa,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QACzC,UAAU,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACxC,gBAAgB;QAChB,yBAAyB,MAAM,CAAC,mBAAmB,EAAE;QACrD,sBAAsB,MAAM,CAAC,gBAAgB,EAAE;QAC/C,SAAS,GAAG,EAAE;QACd,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,IAAI,EAAE,eAAe,6BAA6B,YAAY,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QAC1F,IAAI,EAAE,eAAe,6BAA6B,SAAS,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACzF,IAAI,EAAE,eAAe,6BAA6B,eAAe;QACjE,IAAI,EAAE,eAAe,6BAA6B,wBAAwB,MAAM,CAAC,mBAAmB,EAAE;QACtG,IAAI,EAAE,eAAe,6BAA6B,qBAAqB,MAAM,CAAC,gBAAgB,EAAE;QAChG,IAAI,EAAE,eAAe,6BAA6B,QAAQ,GAAG,EAAE;KAChE,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,oBAAoB;QAC5B,MAAM;QACN,gBAAgB;QAChB,UAAU;QACV,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,OAAgC,EAChC,MAAgC;IAEhC,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,IAAI,EAAE,OAAgB;QACtB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,IAAa;QACtB,WAAW,EAAE,IAAI,CAAC,GAAG;KACtB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,iCAA0C;QACnD,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,oBAAoB;QAC5B,MAAM;QACN,gBAAgB,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;QAC/C,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAW,CAAC;QACtC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM;QACN,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAEtE,MAAM,UAAU,0BAA0B,CACxC,QAA6B,EAC7B,OAAgC,EAChC,MAAgC;IAEhC,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1E,OAAO,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC"}

package/dist/local-actions/providers.d.ts

@@ -0,0 +1,12 @@
+import type { LocalActionKind, LocalActionProvider } from "./contracts.js";
+export type ProviderAuthTopology = "browser_paste_code" | "device_code" | "loopback_callback" | "provider_defined";
+export interface LocalActionProviderDescriptor {
+    readonly provider: LocalActionProvider;
+    readonly enabled: boolean;
+    readonly authTopologies: readonly ProviderAuthTopology[];
+    readonly allowedActions: readonly LocalActionKind[];
+    readonly remoteAdapter: "mcp_stdio";
+}
+export declare const LOCAL_ACTION_PROVIDERS: Readonly<Record<LocalActionProvider, LocalActionProviderDescriptor>>;
+export declare function providerAllowsLocalAction(provider: LocalActionProvider, kind: LocalActionKind): boolean;
+//# sourceMappingURL=providers.d.ts.map

package/dist/local-actions/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/local-actions/providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE3E,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,GAAG,aAAa,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;AAEnH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACzD,QAAQ,CAAC,cAAc,EAAE,SAAS,eAAe,EAAE,CAAC;IACpD,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC;CACrC;AAQD,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,6BAA6B,CAAC,CA+BtG,CAAC;AAEH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAGvG"}

package/dist/local-actions/providers.js

@@ -0,0 +1,42 @@
+const COMMON_ACTIONS = Object.freeze([
+    "browser.open", "clipboard.write", "file.select", "attachment.import", "artifact.save",
+    "port.forward", "preview.open", "diff.open", "editor.open", "notification.show",
+    "git.sign", "local_service.request", "device.select",
+]);
+export const LOCAL_ACTION_PROVIDERS = Object.freeze({
+    "claude-code": Object.freeze({
+        provider: "claude-code",
+        enabled: true,
+        authTopologies: Object.freeze(["browser_paste_code"]),
+        allowedActions: Object.freeze([...COMMON_ACTIONS, "auth.result.observe"]),
+        remoteAdapter: "mcp_stdio",
+    }),
+    codex: Object.freeze({
+        provider: "codex",
+        enabled: true,
+        authTopologies: Object.freeze(["device_code", "loopback_callback"]),
+        allowedActions: Object.freeze([
+            ...COMMON_ACTIONS,
+            "auth.device.present",
+            "auth.callback.relay",
+            "auth.result.observe",
+        ]),
+        remoteAdapter: "mcp_stdio",
+    }),
+    opencode: Object.freeze({
+        provider: "opencode",
+        enabled: true,
+        // OpenCode v1.18.23 owns provider selection and authentication inside its
+        // TUI (`/connect`, then `/models`). It has no Cuna console-device handoff,
+        // so the foreground must not advertise or execute a local auth action for
+        // it. Keeping the provider enabled here preserves direct terminal attach.
+        authTopologies: Object.freeze(["provider_defined"]),
+        allowedActions: Object.freeze([]),
+        remoteAdapter: "mcp_stdio",
+    }),
+});
+export function providerAllowsLocalAction(provider, kind) {
+    const descriptor = LOCAL_ACTION_PROVIDERS[provider];
+    return descriptor !== undefined && descriptor.enabled && descriptor.allowedActions.includes(kind);
+}
+//# sourceMappingURL=providers.js.map

package/dist/local-actions/providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.js","sourceRoot":"","sources":["../../src/local-actions/providers.ts"],"names":[],"mappings":"AAYA,MAAM,cAAc,GAA+B,MAAM,CAAC,MAAM,CAAC;IAC/D,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe;IACtF,cAAc,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB;IAC/E,UAAU,EAAE,uBAAuB,EAAE,eAAe;CACrD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAyE,MAAM,CAAC,MAAM,CAAC;IACxH,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;QAC3B,QAAQ,EAAE,aAAa;QACvB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAkC,CAAC;QACtF,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,cAAc,EAAE,qBAAqB,CAA6B,CAAC;QACrG,aAAa,EAAE,WAAW;KAC3B,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI;QACb,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,mBAAmB,CAAkC,CAAC;QACpG,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC;YAC5B,GAAG,cAAc;YACjB,qBAAqB;YACrB,qBAAqB;YACrB,qBAAqB;SACM,CAAC;QAC9B,aAAa,EAAE,WAAW;KAC3B,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,IAAI;QACb,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAkC,CAAC;QACpF,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAA8B,CAAC;QAC7D,aAAa,EAAE,WAAW;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,UAAU,yBAAyB,CAAC,QAA6B,EAAE,IAAqB;IAC5F,MAAM,UAAU,GAAI,sBAA8F,CAAC,QAAQ,CAAC,CAAC;IAC7H,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC"}

package/dist/local-actions/schemas.d.ts

@@ -0,0 +1,4 @@
+import type { LocalActionRequest, LocalActionResult, LocalActionSafeReason } from "./contracts.js";
+export declare function validateLocalActionArguments(request: LocalActionRequest): void;
+export declare function validateLocalActionResult(request: LocalActionRequest, status: LocalActionResult["status"], safeData?: LocalActionResult["safeData"], safeReason?: LocalActionSafeReason): void;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/local-actions/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../src/local-actions/schemas.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,kBAAkB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAyBxH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAyF9E;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EACnC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,EACxC,UAAU,CAAC,EAAE,qBAAqB,GACjC,IAAI,CA6DN"}