@darkiceinteractive/mcp-conductor 1.1.0 → 3.0.0-beta.1

package/dist/config/defaults.js

@@ -29,7 +29,10 @@ export const DEFAULT_CONFIG = {
     sandbox: {
         maxMemoryMb: 128,
         allowedNetHosts: ['localhost'],
-        maxConcurrentProcesses: 5,
+        // Bumped from 5 → 8 in v2.0.0-alpha.2 (X3 cleanup) per IBKR-side analysis
+        // finding #5. PRD Phase 4's worker pool further parameterises this with
+        // per-server overrides and warm-pool sizing.
+        maxConcurrentProcesses: 8,
         maxOutputBytes: 10 * 1024 * 1024, // 10MB
     },
     skills: {
@@ -95,6 +98,8 @@ export const DEFAULT_CONDUCTOR_CONFIG = {
  * - `STREAM_STUCK_TTL_MS` — `StreamManager` cleanup for hung running streams
  * - `STREAM_CLEANUP_INTERVAL_MS` — `StreamManager` tick rate for the sweep
  * - `MEMORY_LOG_INTERVAL_MS` — periodic heap/RSS log from the main entry point
+ * - `BRIDGE_SESSION_TTL_MS` — HTTP bridge session idle expiry (Mcp-Session-Id)
+ * - `BRIDGE_SESSION_CLEANUP_INTERVAL_MS` — sweep cadence for expired sessions
  */
 export const LIFECYCLE_TIMEOUTS = {
     SHUTDOWN_TIMEOUT_MS: 10_000,
@@ -104,5 +109,13 @@ export const LIFECYCLE_TIMEOUTS = {
     STREAM_STUCK_TTL_MS: 15 * 60_000,
     STREAM_CLEANUP_INTERVAL_MS: 60_000,
     MEMORY_LOG_INTERVAL_MS: 60_000,
+    BRIDGE_SESSION_TTL_MS: 30 * 60_000,
+    BRIDGE_SESSION_CLEANUP_INTERVAL_MS: 5 * 60_000,
+    ORPHAN_CHECK_INTERVAL_MS: 10_000,
 };
+/**
+ * Cap on simultaneously tracked bridge sessions. Bounded to prevent the
+ * session registry from growing unbounded if a client keeps rotating IDs.
+ */
+export const MAX_BRIDGE_SESSIONS = 1000;
 //# sourceMappingURL=defaults.js.map

package/dist/config/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,EAAE,2DAA2D;QACpE,IAAI,EAAE,WAAW;KAClB;IACD,SAAS,EAAE;QACT,IAAI,EAAE,WAAW;QACjB,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,MAAM;QACpB,gBAAgB,EAAE,IAAI;KACvB;IACD,OAAO,EAAE;QACP,WAAW,EAAE,GAAG;QAChB,eAAe,EAAE,CAAC,WAAW,CAAC;QAC9B,sBAAsB,EAAE,CAAC;QACzB,cAAc,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;KAC1C;IACD,MAAM,EAAE;QACN,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,IAAI;KACtB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,GAAG;KAChB;IACD,OAAO,EAAE;QACP,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,IAAI;KACd;IACD,OAAO,EAAE;QACP,SAAS,EAAE,CAAC,GAAG,CAAC;QAChB,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,mBAAmB;IACzB,OAAO,EAAE,sBAAsB;IAC/B,WAAW,EAAE,0BAA0B;IACvC,SAAS,EAAE,wBAAwB;IACnC,MAAM,EAAE,qBAAqB;IAC7B,aAAa,EAAE,4BAA4B;IAC3C,gBAAgB,EAAE,sBAAsB;IACxC,WAAW,EAAE,0BAA0B;IACvC,YAAY,EAAE,2BAA2B;IACzC,YAAY,EAAE,2BAA2B;IACzC,cAAc,EAAE,6BAA6B;IAC7C,eAAe,EAAE,8BAA8B;IAC/C,aAAa,EAAE,4BAA4B;CACnC,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,SAAS,EAAE,IAAI;IACf,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,mBAAmB,EAAE,MAAM;IAC3B,qBAAqB,EAAE,KAAK;IAC5B,mBAAmB,EAAE,CAAC,GAAG,MAAM;IAC/B,uBAAuB,EAAE,EAAE,GAAG,MAAM;IACpC,mBAAmB,EAAE,EAAE,GAAG,MAAM;IAChC,0BAA0B,EAAE,MAAM;IAClC,sBAAsB,EAAE,MAAM;CACtB,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,MAAM,EAAE;QACN,IAAI,EAAE,CAAC,EAAE,2DAA2D;QACpE,IAAI,EAAE,WAAW;KAClB;IACD,SAAS,EAAE;QACT,IAAI,EAAE,WAAW;QACjB,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,MAAM;QACpB,gBAAgB,EAAE,IAAI;KACvB;IACD,OAAO,EAAE;QACP,WAAW,EAAE,GAAG;QAChB,eAAe,EAAE,CAAC,WAAW,CAAC;QAC9B,0EAA0E;QAC1E,wEAAwE;QACxE,6CAA6C;QAC7C,sBAAsB,EAAE,CAAC;QACzB,cAAc,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;KAC1C;IACD,MAAM,EAAE;QACN,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,IAAI;KACtB;IACD,SAAS,EAAE;QACT,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,GAAG;KAChB;IACD,OAAO,EAAE;QACP,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,IAAI;KACd;IACD,OAAO,EAAE;QACP,SAAS,EAAE,CAAC,GAAG,CAAC;QAChB,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,mBAAmB;IACzB,OAAO,EAAE,sBAAsB;IAC/B,WAAW,EAAE,0BAA0B;IACvC,SAAS,EAAE,wBAAwB;IACnC,MAAM,EAAE,qBAAqB;IAC7B,aAAa,EAAE,4BAA4B;IAC3C,gBAAgB,EAAE,sBAAsB;IACxC,WAAW,EAAE,0BAA0B;IACvC,YAAY,EAAE,2BAA2B;IACzC,YAAY,EAAE,2BAA2B;IACzC,cAAc,EAAE,6BAA6B;IAC7C,eAAe,EAAE,8BAA8B;IAC/C,aAAa,EAAE,4BAA4B;CACnC,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,SAAS,EAAE,IAAI;IACf,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,mBAAmB,EAAE,MAAM;IAC3B,qBAAqB,EAAE,KAAK;IAC5B,mBAAmB,EAAE,CAAC,GAAG,MAAM;IAC/B,uBAAuB,EAAE,EAAE,GAAG,MAAM;IACpC,mBAAmB,EAAE,EAAE,GAAG,MAAM;IAChC,0BAA0B,EAAE,MAAM;IAClC,sBAAsB,EAAE,MAAM;IAC9B,qBAAqB,EAAE,EAAE,GAAG,MAAM;IAClC,kCAAkC,EAAE,CAAC,GAAG,MAAM;IAC9C,wBAAwB,EAAE,MAAM;CACxB,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC"}

package/dist/config/schema.d.ts

@@ -92,4 +92,38 @@ export interface ConductorConfig {
     /** MCP servers that conductor will connect to internally */
     servers: Record<string, ConductorServerConfig>;
 }
+/**
+ * Connection pool configuration for persistent stdio connections to MCP
+ * backend servers. Reduces cold-start latency by keeping connections alive
+ * and multiplexing JSON-RPC requests over the same stdio channel.
+ */
+export interface ConnectionPoolConfig {
+    /** Minimum idle connections to keep per server (default: 1) */
+    minConnectionsPerServer?: number;
+    /** Maximum simultaneous connections per server (default: 4) */
+    maxConnectionsPerServer?: number;
+    /** Idle connection shutdown timeout in ms (default: 300000 = 5 min) */
+    idleTimeoutMs?: number;
+    /** Timeout for acquiring a connection from the pool (default: 5000) */
+    acquireTimeoutMs?: number;
+}
+/**
+ * Warm Deno worker pool configuration. Workers are pre-spawned at startup
+ * so the first execute_code call hits an already-warm sandbox.
+ */
+export interface WorkerPoolConfig {
+    /** Number of warm workers to maintain (default: 4) */
+    size?: number;
+    /** Recycle a worker after this many jobs (default: 100) */
+    maxJobsPerWorker?: number;
+    /** Recycle a worker after this many ms since spawn (default: 600000 = 10 min) */
+    maxAgeMs?: number;
+}
+/**
+ * Phase 4 runtime pool configuration block (nested under `runtime` in conductor config).
+ */
+export interface RuntimePoolConfig {
+    workerPool?: WorkerPoolConfig;
+    connectionPool?: ConnectionPoolConfig;
+}
 //# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9B,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kDAAkD;IAClD,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAChD"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEnE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9B,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IACrC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,yDAAyD;IACzD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kDAAkD;IAClD,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,SAAS,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAChD;AAMD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,+DAA+D;IAC/D,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC"}

package/dist/daemon/client.d.ts

@@ -0,0 +1,97 @@
+/**
+ * MCP Conductor Daemon Client.
+ *
+ * Thin agent-side bridge that connects to a running DaemonServer over a Unix
+ * socket or TCP and exposes a `callTool` interface compatible with the direct
+ * execution path. Authentication uses HMAC-SHA256 with the shared secret read
+ * from `~/.mcp-conductor/daemon-auth.json`.
+ *
+ * The sandbox `mcp.shared.*` API is built on top of this client.
+ *
+ * @module daemon/client
+ */
+import type { KVSetOptions } from './shared-kv.js';
+export interface DaemonClientOptions {
+    /** Unix socket path. Defaults to `~/.mcp-conductor/daemon.sock`. */
+    socketPath?: string;
+    /**
+     * TCP address of the daemon when connecting over Tailscale.
+     * Format: `"host:port"` e.g. `"100.64.0.1:9876"`.
+     */
+    tailscaleAddress?: string;
+    /** Auth configuration. */
+    auth?: {
+        sharedSecretPath?: string;
+        sharedSecret?: string;
+    };
+    /** Connection timeout in ms. Defaults to 5 000. */
+    connectTimeoutMs?: number;
+}
+/**
+ * Client-side bridge to the daemon.
+ *
+ * Usage:
+ * ```typescript
+ * const client = new DaemonClient();
+ * await client.connect();
+ * const result = await client.callTool('list_tools', {});
+ * await client.disconnect();
+ * ```
+ */
+export declare class DaemonClient {
+    private readonly socketPath;
+    private readonly tailscaleAddress?;
+    private readonly sharedSecret;
+    private readonly connectTimeoutMs;
+    private socket;
+    private connected;
+    private readonly pending;
+    private buffer;
+    private nextId;
+    constructor(options?: DaemonClientOptions);
+    /**
+     * Connect to the daemon and complete the auth handshake.
+     */
+    connect(): Promise<void>;
+    /**
+     * Gracefully disconnect.
+     */
+    disconnect(): Promise<void>;
+    /**
+     * Call an MCP tool via the daemon.
+     */
+    callTool(name: string, args: unknown): Promise<unknown>;
+    /**
+     * Ping the daemon. Useful for health-checks.
+     */
+    ping(): Promise<void>;
+    /** Retrieve daemon statistics. */
+    stats(): Promise<unknown>;
+    kvGet<T>(key: string): Promise<T | null>;
+    kvSet<T>(key: string, value: T, options?: KVSetOptions): Promise<void>;
+    kvDelete(key: string): Promise<void>;
+    kvList(prefix?: string): Promise<string[]>;
+    lockAcquire(key: string, options?: {
+        timeoutMs?: number;
+    }): Promise<{
+        release: () => Promise<void>;
+    }>;
+    broadcast(channel: string, message: unknown): Promise<void>;
+    /**
+     * Subscribe to a channel. The handler is invoked for each push event
+     * received from the daemon.  Returns an object with `unsubscribe()`.
+     */
+    subscribe(channel: string, handler: (msg: unknown) => void): {
+        unsubscribe: () => void;
+    };
+    private readonly pushListeners;
+    private loadSecret;
+    private openSocket;
+    private authenticate;
+    private waitForMessage;
+    private rpc;
+    private onData;
+    private handleResponse;
+    private rejectAllPending;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/daemon/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/daemon/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAkCnD,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0BAA0B;IAC1B,IAAI,CAAC,EAAE;QACL,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,mDAAmD;IACnD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAE1C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,MAAM,CAAK;gBAEP,OAAO,GAAE,mBAAwB;IAiB7C;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB9B;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBjC;;OAEG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7D;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B,kCAAkC;IAC5B,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;IAQzB,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAIxC,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAQ1C,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IAarG,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjE;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE;IAiBxF,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IAMnE,OAAO,CAAC,UAAU;IAWlB,OAAO,CAAC,UAAU;YA4BJ,YAAY;IAU1B,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,GAAG;IAoBX,OAAO,CAAC,MAAM;IAiBd,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,gBAAgB;CAMzB"}

package/dist/daemon/client.js

@@ -0,0 +1,279 @@
+/**
+ * MCP Conductor Daemon Client.
+ *
+ * Thin agent-side bridge that connects to a running DaemonServer over a Unix
+ * socket or TCP and exposes a `callTool` interface compatible with the direct
+ * execution path. Authentication uses HMAC-SHA256 with the shared secret read
+ * from `~/.mcp-conductor/daemon-auth.json`.
+ *
+ * The sandbox `mcp.shared.*` API is built on top of this client.
+ *
+ * @module daemon/client
+ */
+import { createConnection } from 'node:net';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { createHmac } from 'node:crypto';
+import { logger } from '../utils/logger.js';
+const DEFAULT_SOCKET_PATH = join(homedir(), '.mcp-conductor', 'daemon.sock');
+const DEFAULT_AUTH_PATH = join(homedir(), '.mcp-conductor', 'daemon-auth.json');
+/**
+ * Client-side bridge to the daemon.
+ *
+ * Usage:
+ * ```typescript
+ * const client = new DaemonClient();
+ * await client.connect();
+ * const result = await client.callTool('list_tools', {});
+ * await client.disconnect();
+ * ```
+ */
+export class DaemonClient {
+    socketPath;
+    tailscaleAddress;
+    sharedSecret;
+    connectTimeoutMs;
+    socket = null;
+    connected = false;
+    pending = new Map();
+    buffer = '';
+    nextId = 1;
+    constructor(options = {}) {
+        this.socketPath = options.socketPath ?? DEFAULT_SOCKET_PATH;
+        this.tailscaleAddress = options.tailscaleAddress;
+        this.connectTimeoutMs = options.connectTimeoutMs ?? 5_000;
+        const authPath = options.auth?.sharedSecretPath ?? DEFAULT_AUTH_PATH;
+        if (options.auth?.sharedSecret) {
+            this.sharedSecret = options.auth.sharedSecret;
+        }
+        else {
+            this.sharedSecret = this.loadSecret(authPath);
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Lifecycle
+    // ---------------------------------------------------------------------------
+    /**
+     * Connect to the daemon and complete the auth handshake.
+     */
+    async connect() {
+        if (this.connected)
+            return;
+        const socket = await this.openSocket();
+        this.socket = socket;
+        socket.setEncoding('utf-8');
+        socket.on('data', (chunk) => this.onData(chunk));
+        socket.on('close', () => {
+            this.connected = false;
+            this.rejectAllPending(new Error('DaemonClient: connection closed'));
+        });
+        socket.on('error', (err) => {
+            logger.debug('DaemonClient: socket error', { error: String(err) });
+            this.rejectAllPending(err);
+        });
+        // Complete challenge-response auth.
+        await this.authenticate();
+        this.connected = true;
+        logger.debug('DaemonClient: connected and authenticated');
+    }
+    /**
+     * Gracefully disconnect.
+     */
+    async disconnect() {
+        this.connected = false;
+        if (this.socket && !this.socket.destroyed) {
+            this.socket.end();
+            await new Promise((resolve) => {
+                this.socket.once('close', resolve);
+                setTimeout(resolve, 1000);
+            });
+        }
+        this.socket = null;
+        logger.debug('DaemonClient: disconnected');
+    }
+    // ---------------------------------------------------------------------------
+    // Public RPC surface
+    // ---------------------------------------------------------------------------
+    /**
+     * Call an MCP tool via the daemon.
+     */
+    async callTool(name, args) {
+        return this.rpc('tool.call', { name, args });
+    }
+    /**
+     * Ping the daemon. Useful for health-checks.
+     */
+    async ping() {
+        await this.rpc('ping', {});
+    }
+    /** Retrieve daemon statistics. */
+    async stats() {
+        return this.rpc('stats', {});
+    }
+    // ---------------------------------------------------------------------------
+    // Shared KV API
+    // ---------------------------------------------------------------------------
+    async kvGet(key) {
+        return this.rpc('kv.get', { key });
+    }
+    async kvSet(key, value, options) {
+        await this.rpc('kv.set', { key, value, options });
+    }
+    async kvDelete(key) {
+        await this.rpc('kv.delete', { key });
+    }
+    async kvList(prefix) {
+        return this.rpc('kv.list', { prefix });
+    }
+    // ---------------------------------------------------------------------------
+    // Shared lock API
+    // ---------------------------------------------------------------------------
+    async lockAcquire(key, options) {
+        await this.rpc('lock.acquire', { key, timeoutMs: options?.timeoutMs });
+        return {
+            release: async () => {
+                await this.rpc('lock.release', { key });
+            },
+        };
+    }
+    // ---------------------------------------------------------------------------
+    // Pub/sub API
+    // ---------------------------------------------------------------------------
+    async broadcast(channel, message) {
+        await this.rpc('broadcast', { channel, message });
+    }
+    /**
+     * Subscribe to a channel. The handler is invoked for each push event
+     * received from the daemon.  Returns an object with `unsubscribe()`.
+     */
+    subscribe(channel, handler) {
+        const listener = (msg) => {
+            const push = msg;
+            if (push.channel === channel) {
+                handler(push.message);
+            }
+        };
+        this.pushListeners.add(listener);
+        // Best-effort fire-and-forget notification to the server.
+        this.rpc('subscribe', { channel }).catch(() => { });
+        return {
+            unsubscribe: () => {
+                this.pushListeners.delete(listener);
+            },
+        };
+    }
+    pushListeners = new Set();
+    // ---------------------------------------------------------------------------
+    // Private helpers
+    // ---------------------------------------------------------------------------
+    loadSecret(authPath) {
+        if (!existsSync(authPath)) {
+            throw new Error(`DaemonClient: auth file not found at ${authPath}. ` +
+                'Start the daemon first with `mcp-conductor-cli daemon start`.');
+        }
+        const raw = readFileSync(authPath, 'utf-8');
+        return JSON.parse(raw).sharedSecret;
+    }
+    openSocket() {
+        return new Promise((resolve, reject) => {
+            let socket;
+            const timer = setTimeout(() => {
+                socket?.destroy();
+                reject(new Error(`DaemonClient: connection timed out after ${this.connectTimeoutMs}ms`));
+            }, this.connectTimeoutMs);
+            if (this.tailscaleAddress) {
+                const [host, portStr] = this.tailscaleAddress.split(':');
+                const port = parseInt(portStr ?? '9876', 10);
+                socket = createConnection({ host, port });
+            }
+            else {
+                socket = createConnection({ path: this.socketPath });
+            }
+            socket.once('connect', () => {
+                clearTimeout(timer);
+                resolve(socket);
+            });
+            socket.once('error', (err) => {
+                clearTimeout(timer);
+                reject(err);
+            });
+        });
+    }
+    async authenticate() {
+        // Wait for the challenge from the server.
+        const challenge = await this.waitForMessage('__auth_challenge__');
+        const nonce = challenge.nonce;
+        // Compute HMAC token and send auth response.
+        const token = createHmac('sha256', this.sharedSecret).update(nonce).digest('hex');
+        await this.rpc('__auth__', { token });
+    }
+    waitForMessage(id) {
+        return new Promise((resolve, reject) => {
+            this.pending.set(id, { resolve, reject });
+        });
+    }
+    rpc(method, params) {
+        return new Promise((resolve, reject) => {
+            if (!this.socket || this.socket.destroyed) {
+                reject(new Error('DaemonClient: not connected'));
+                return;
+            }
+            const id = String(this.nextId++);
+            this.pending.set(id, { resolve, reject });
+            const msg = { id, method, params };
+            try {
+                this.socket.write(JSON.stringify(msg) + '\n');
+            }
+            catch (err) {
+                this.pending.delete(id);
+                reject(err);
+            }
+        });
+    }
+    onData(chunk) {
+        this.buffer += chunk;
+        const lines = this.buffer.split('\n');
+        this.buffer = lines.pop() ?? '';
+        for (const line of lines) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            try {
+                const msg = JSON.parse(trimmed);
+                this.handleResponse(msg);
+            }
+            catch {
+                logger.warn('DaemonClient: malformed JSON from server');
+            }
+        }
+    }
+    handleResponse(msg) {
+        // Push events (id === '__push__') are delivered to pub/sub listeners.
+        if (msg.id === '__push__') {
+            for (const listener of this.pushListeners) {
+                listener(msg.result);
+            }
+            return;
+        }
+        const call = this.pending.get(msg.id);
+        if (!call) {
+            logger.warn('DaemonClient: received response for unknown id', { id: msg.id });
+            return;
+        }
+        this.pending.delete(msg.id);
+        if (msg.error) {
+            call.reject(new Error(`RPC error ${msg.error.code}: ${msg.error.message}`));
+        }
+        else {
+            call.resolve(msg.result);
+        }
+    }
+    rejectAllPending(err) {
+        for (const [id, call] of this.pending) {
+            this.pending.delete(id);
+            call.reject(err);
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/daemon/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/daemon/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAe,MAAM,UAAU,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AA4B5C,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;AAC7E,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;AAuBhF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,YAAY;IACN,UAAU,CAAS;IACnB,gBAAgB,CAAU;IAC1B,YAAY,CAAS;IACrB,gBAAgB,CAAS;IAElC,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAAG,KAAK,CAAC;IACT,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAClD,MAAM,GAAG,EAAE,CAAC;IACZ,MAAM,GAAG,CAAC,CAAC;IAEnB,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC5D,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;QAE1D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,gBAAgB,IAAI,iBAAiB,CAAC;QACrE,IAAI,OAAO,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,YAAY;IACZ,8EAA8E;IAE9E;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAE3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEH,oCAAoC;QACpC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YAClB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7C,CAAC;IAED,8EAA8E;IAC9E,qBAAqB;IACrB,8EAA8E;IAE9E;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAAa;QACxC,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,8EAA8E;IAC9E,gBAAgB;IAChB,8EAA8E;IAE9E,KAAK,CAAC,KAAK,CAAI,GAAW;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAsB,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,GAAW,EAAE,KAAQ,EAAE,OAAsB;QAC1D,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAW;QACxB,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAe;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAsB,CAAC;IAC9D,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,OAAgC;QAC7D,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,OAAO;YACL,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClB,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1C,CAAC;SACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,cAAc;IACd,8EAA8E;IAE9E,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,OAAgB;QAC/C,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,OAAe,EAAE,OAA+B;QACxD,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,EAAE;YAChC,MAAM,IAAI,GAAG,GAA8C,CAAC;YAC5D,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,0DAA0D;QAC1D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnD,OAAO;YACL,WAAW,EAAE,GAAG,EAAE;gBAChB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;SACF,CAAC;IACJ,CAAC;IAEgB,aAAa,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEnE,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAEtE,UAAU,CAAC,QAAgB;QACjC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,IAAI;gBACpD,+DAA+D,CAChE,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC,YAAY,CAAC;IACpD,CAAC;IAEO,UAAU;QAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,MAAc,CAAC;YAEnB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,MAAM,EAAE,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC;YAC3F,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAE1B,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC7C,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC3B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,0CAA0C;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;QAClE,MAAM,KAAK,GAAI,SAA+B,CAAC,KAAK,CAAC;QAErD,6CAA6C;QAC7C,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClF,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,CAAC;IAEO,cAAc,CAAC,EAAU;QAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,MAAgB;QAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC1C,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;YAED,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAE1C,MAAM,GAAG,GAAe,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;gBAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,GAAgB;QACrC,sEAAsE;QACtE,IAAI,GAAG,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YAC1B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1C,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAE5B,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,GAAU;QACjC,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;CACF"}

package/dist/daemon/discovery.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Tailscale Peer Discovery for MCP Conductor Daemon.
+ *
+ * Provides helpers to resolve a daemon's address on the Tailscale mesh by
+ * hostname. The implementation queries the local Tailscale CLI (`tailscale
+ * status --json`) which must already be authenticated. No additional Tailscale
+ * API token is required — this works entirely through the local socket that
+ * the Tailscale daemon exposes.
+ *
+ * Cross-daemon mesh locking is deferred to v3.1; this module's v3.0 role is:
+ *  1. Resolve a Tailscale hostname → IP so DaemonClient can connect via TCP.
+ *  2. Detect whether Tailscale is available at all (graceful fallback to Unix
+ *     socket when Tailscale is absent).
+ *
+ * @module daemon/discovery
+ */
+export interface TailscalePeer {
+    hostname: string;
+    tailscaleIp: string;
+    online: boolean;
+}
+export interface TailscaleStatus {
+    available: boolean;
+    selfHostname?: string;
+    selfIp?: string;
+    peers: TailscalePeer[];
+}
+/**
+ * Resolves daemon addresses on the Tailscale mesh by querying the local
+ * Tailscale CLI.
+ */
+export declare class TailscaleDiscovery {
+    private readonly tailscaleBin;
+    private readonly cacheTtlMs;
+    private cache;
+    /**
+     * Internal CLI runner — override in tests via `vi.spyOn(instance, '_runCli')`.
+     */
+    _runCli: (bin: string) => Promise<string>;
+    constructor(options?: {
+        tailscaleBin?: string;
+        cacheTtlMs?: number;
+    });
+    status(): Promise<TailscaleStatus>;
+    resolve(hostname: string): Promise<string | null>;
+    isAvailable(): Promise<boolean>;
+    invalidateCache(): void;
+    private queryTailscaleCli;
+}
+//# sourceMappingURL=discovery.d.ts.map

package/dist/daemon/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/daemon/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AA4BD;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,KAAK,CAA+D;IAE5E;;OAEG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;gBAE9B,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO;IAMlE,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC;IAUlC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAcjD,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAKrC,eAAe,IAAI,IAAI;YAIT,iBAAiB;CA4BhC"}

package/dist/daemon/discovery.js

@@ -0,0 +1,104 @@
+/**
+ * Tailscale Peer Discovery for MCP Conductor Daemon.
+ *
+ * Provides helpers to resolve a daemon's address on the Tailscale mesh by
+ * hostname. The implementation queries the local Tailscale CLI (`tailscale
+ * status --json`) which must already be authenticated. No additional Tailscale
+ * API token is required — this works entirely through the local socket that
+ * the Tailscale daemon exposes.
+ *
+ * Cross-daemon mesh locking is deferred to v3.1; this module's v3.0 role is:
+ *  1. Resolve a Tailscale hostname → IP so DaemonClient can connect via TCP.
+ *  2. Detect whether Tailscale is available at all (graceful fallback to Unix
+ *     socket when Tailscale is absent).
+ *
+ * @module daemon/discovery
+ */
+import { execFile } from 'node:child_process';
+import { logger } from '../utils/logger.js';
+/**
+ * Runs the Tailscale CLI and returns its JSON output.
+ * Extracted so tests can override via `vi.spyOn(discovery, '_runCli')`.
+ */
+async function runTailscaleCli(bin) {
+    return new Promise((resolve, reject) => {
+        execFile(bin, ['status', '--json'], { timeout: 5000 }, (err, stdout) => {
+            if (err)
+                reject(err);
+            else
+                resolve(stdout);
+        });
+    });
+}
+/**
+ * Resolves daemon addresses on the Tailscale mesh by querying the local
+ * Tailscale CLI.
+ */
+export class TailscaleDiscovery {
+    tailscaleBin;
+    cacheTtlMs;
+    cache = null;
+    /**
+     * Internal CLI runner — override in tests via `vi.spyOn(instance, '_runCli')`.
+     */
+    _runCli;
+    constructor(options = {}) {
+        this.tailscaleBin = options.tailscaleBin ?? 'tailscale';
+        this.cacheTtlMs = options.cacheTtlMs ?? 10_000;
+        this._runCli = runTailscaleCli;
+    }
+    async status() {
+        if (this.cache && Date.now() < this.cache.expiresAt) {
+            return this.cache.status;
+        }
+        const result = await this.queryTailscaleCli();
+        this.cache = { expiresAt: Date.now() + this.cacheTtlMs, status: result };
+        return result;
+    }
+    async resolve(hostname) {
+        const st = await this.status();
+        if (!st.available)
+            return null;
+        if (st.selfHostname?.toLowerCase() === hostname.toLowerCase()) {
+            return st.selfIp ?? null;
+        }
+        const peer = st.peers.find((p) => p.hostname.toLowerCase() === hostname.toLowerCase());
+        return peer?.tailscaleIp ?? null;
+    }
+    async isAvailable() {
+        const st = await this.status();
+        return st.available;
+    }
+    invalidateCache() {
+        this.cache = null;
+    }
+    async queryTailscaleCli() {
+        try {
+            const stdout = await this._runCli(this.tailscaleBin);
+            const raw = JSON.parse(stdout);
+            const self = raw.Self;
+            const peers = [];
+            for (const peer of Object.values(raw.Peer ?? {})) {
+                const ip = peer.TailscaleIPs?.[0];
+                if (!ip || !peer.HostName)
+                    continue;
+                peers.push({
+                    hostname: peer.HostName,
+                    tailscaleIp: ip,
+                    online: peer.Online ?? false,
+                });
+            }
+            return {
+                available: true,
+                selfHostname: self?.HostName,
+                selfIp: self?.TailscaleIPs?.[0],
+                peers,
+            };
+        }
+        catch (err) {
+            logger.debug('TailscaleDiscovery: Tailscale CLI unavailable', { error: String(err) });
+            return { available: false, peers: [] };
+        }
+    }
+}
+//# sourceMappingURL=discovery.js.map

package/dist/daemon/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/daemon/discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AA4B5C;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACrE,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACZ,YAAY,CAAS;IACrB,UAAU,CAAS;IAC5B,KAAK,GAA0D,IAAI,CAAC;IAE5E;;OAEG;IACH,OAAO,CAAmC;IAE1C,YAAY,UAA0D,EAAE;QACtE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,WAAW,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACzE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE/B,IAAI,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YAC9D,OAAO,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC;QAC3B,CAAC;QAED,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAC3D,CAAC;QACF,OAAO,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC,SAAS,CAAC;IACtB,CAAC;IAED,eAAe;QACb,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAuB,CAAC;YACrD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YACtB,MAAM,KAAK,GAAoB,EAAE,CAAC;YAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;gBACjD,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC;gBAClC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBACpC,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,WAAW,EAAE,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;iBAC7B,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,IAAI,EAAE,QAAQ;gBAC5B,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;gBAC/B,KAAK;aACN,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtF,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;CACF"}