@dev-mainsequence/codex-plugin 0.0.0-stage → 0.4.2

package/dist/vendor/devtools/shared/mcp.js

@@ -0,0 +1,421 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpConnections = void 0;
+const fs = __importStar(require("node:fs/promises"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const node_crypto_1 = require("node:crypto");
+const models_1 = require("./models.js");
+const session_1 = require("./session.js");
+const mcpTransport_1 = require("./mcpTransport.js");
+const repositoryModels_1 = require("./repositoryModels.js");
+const environments_1 = require("./environments.js");
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function uuid(value) {
+    if (typeof value !== 'string' || !UUID.test(value)) {
+        throw new models_1.ToolingError('INVALID_REQUEST', 'Select an exact resource release UUID from MCP discovery or saved connections.');
+    }
+    return value.toLowerCase();
+}
+/** Optional labels: an absent or malformed value is dropped, never an error. */
+function labels(row) {
+    const text = (value) => typeof value === 'string' && value.trim() && !/[\r\n\0]/.test(value) ? value.trim() : undefined;
+    const name = text(row?.name), display = text(row?.display_name);
+    const branch = typeof row?.code_repository_branch_uid === 'string' && UUID.test(row.code_repository_branch_uid) ? row.code_repository_branch_uid.toLowerCase() : undefined;
+    return { ...(name ? { name } : {}), ...(display ? { display_name: display } : {}), ...(branch ? { code_repository_branch_uid: branch } : {}) };
+}
+function endpoint(value, metadata = false) {
+    if (typeof value !== 'string')
+        throw new models_1.ToolingError('API_ERROR', 'The backend returned no MCP endpoint.');
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new models_1.ToolingError('API_ERROR', 'The backend returned an invalid MCP endpoint.');
+    }
+    if (url.username || url.password || (!metadata && url.search) || url.hash || /[\r\n\0]/.test(value)
+        || (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))) {
+        throw new models_1.ToolingError('API_ERROR', 'An HTTPS endpoint, or loopback HTTP endpoint for local development, is required.');
+    }
+    return value;
+}
+function connection(backend, row) {
+    const c = row?.mcp_connection;
+    if (!c || c.transport !== 'streamable-http') {
+        throw new models_1.ToolingError('API_ERROR', 'The selected release has no active platform MCP connection.');
+    }
+    const url = endpoint(c.url);
+    if (new URL(url).pathname !== '/mcp')
+        throw new models_1.ToolingError('API_ERROR', 'The release returned a non-canonical MCP endpoint.');
+    const releaseUid = uuid(row.resource_release_uid ?? row.uid), metadataUrl = endpoint(c.resource_metadata_url, true);
+    const metadataQuery = new URL(metadataUrl).searchParams;
+    if ([...metadataQuery.keys()].some(key => key !== 'resource_release_uid') || metadataQuery.getAll('resource_release_uid').length !== 1
+        || metadataQuery.get('resource_release_uid') !== releaseUid)
+        throw new models_1.ToolingError('API_ERROR', 'The MCP metadata targets another release.');
+    return { backend: (0, session_1.requireBackend)(backend), resource_release_uid: releaseUid, ...labels(row),
+        mcp_connection: { url, transport: 'streamable-http', resource_metadata_url: metadataUrl,
+            organization_environment_uid: uuid(c.organization_environment_uid),
+            ...(typeof c.organization_environment_name === 'string' && c.organization_environment_name.trim() ? { organization_environment_name: c.organization_environment_name.trim() } : {}), active_revision_uid: uuid(c.active_revision_uid) } };
+}
+function storagePath(env) {
+    const dir = process.platform === 'darwin' ? path.join(os.homedir(), 'Library', 'Application Support', 'MainSequenceCLI')
+        : process.platform === 'win32' ? path.join(env.APPDATA || os.homedir(), 'MainSequenceCLI') : path.join(os.homedir(), '.config', 'mainsequence');
+    return path.join(dir, 'mcp-connections.json');
+}
+/** Only endpoint metadata is persisted. Release credentials exist in one invocation's memory. */
+class McpConnections {
+    session;
+    options;
+    file;
+    secrets = new Set();
+    constructor(session, options = {}) {
+        this.session = session;
+        this.options = options;
+        this.file = options.connectionsPath ?? storagePath(options.env ?? process.env);
+    }
+    sanitize(value) {
+        if (typeof value === 'string') {
+            for (const secret of this.secrets)
+                value = value.split(secret).join('[redacted]');
+            return this.session.sanitize?.(value) ?? value;
+        }
+        if (Array.isArray(value))
+            return value.map(item => this.sanitize(item));
+        if (value && typeof value === 'object')
+            return Object.fromEntries(Object.entries(value).map(([key, item]) => [this.sanitize(key), this.sanitize(item)]));
+        return value;
+    }
+    async read() {
+        try {
+            const stat = await fs.lstat(this.file);
+            if (!stat.isFile() || stat.size > 2_000_000)
+                throw new Error('invalid store');
+            const rows = JSON.parse(await fs.readFile(this.file, 'utf8'));
+            if (!Array.isArray(rows))
+                throw new Error('invalid store');
+            return rows.map(row => connection(row.backend, row));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw new models_1.ToolingError('STORE_ERROR', 'Saved MCP connections could not be read. The existing file has been kept.');
+        }
+    }
+    async update(change) {
+        this.options.signal?.throwIfAborted();
+        await this.options.checkAccount?.();
+        await fs.mkdir(path.dirname(this.file), { recursive: true, mode: 0o700 });
+        const lock = this.file + '.lock', temporary = this.file + '.' + (0, node_crypto_1.randomUUID)() + '.tmp';
+        let handle;
+        try {
+            handle = await fs.open(lock, 'wx', 0o600);
+        }
+        catch {
+            throw new models_1.ToolingError('PROJECT_BUSY', 'Another action holds the saved MCP connection lock. After an interrupted action, verify it has stopped before removing ' + lock + '.');
+        }
+        try {
+            await handle.writeFile(JSON.stringify({ pid: process.pid }));
+            const rows = change(await this.read());
+            this.options.signal?.throwIfAborted();
+            const serialized = JSON.stringify(rows, null, 2) + '\n';
+            if (Buffer.byteLength(serialized) > 2_000_000)
+                throw new models_1.ToolingError('PERSISTENCE_FAILED', 'The saved MCP connections exceed the client limit.');
+            await fs.writeFile(temporary, serialized, { flag: 'wx', mode: 0o600 });
+            await fs.rename(temporary, this.file);
+        }
+        catch (error) {
+            if (error instanceof models_1.ToolingError)
+                throw error;
+            throw new models_1.ToolingError('PERSISTENCE_FAILED', 'The MCP connections could not be saved.');
+        }
+        finally {
+            await fs.rm(temporary, { force: true });
+            await handle.close();
+            await fs.unlink(lock);
+        }
+    }
+    async current(backend, releaseUid) {
+        const row = await this.session.request(backend, 'GET', '/api/v1/resource-releases/' + releaseUid + '/');
+        const value = connection(backend, row);
+        if (value.resource_release_uid !== releaseUid)
+            throw new models_1.ToolingError('API_ERROR', 'The backend returned a different release.');
+        return value;
+    }
+    async open(value) {
+        const grant = await this.session.request(value.backend, 'GET', '/api/v1/resource-releases/' + value.resource_release_uid + '/exchange-launch/');
+        if (grant?.mode !== 'token' || grant.release_kind !== 'fastapi' || typeof grant.token !== 'string' || !grant.token || /[\r\n]/.test(grant.token)) {
+            throw new models_1.ToolingError('API_ERROR', 'The backend returned no usable FastAPI release credential.');
+        }
+        this.secrets.add(grant.token);
+        if (new URL(endpoint(grant.rpc_url)).origin !== new URL(value.mcp_connection.url).origin) {
+            throw new models_1.ToolingError('API_ERROR', 'The release credential targets a different endpoint.');
+        }
+        const client = new mcpTransport_1.McpTransport(async (message) => {
+            await this.options.checkAccount?.();
+            const result = await (0, mcpTransport_1.sendProjectMcp)(value.mcp_connection.url, grant.token, message, this.options);
+            await this.options.checkAccount?.();
+            return result;
+        });
+        await client.initialize();
+        return client;
+    }
+    /** The release's name and repository from the release directory and its branch. Whatever
+     * cannot be read is left out: labels never make a working MCP unavailable. */
+    async resolveLabels(value) {
+        const found = {};
+        const read = async (apiPath) => {
+            try {
+                return await this.session.request(value.backend, 'GET', apiPath, undefined, true);
+            }
+            catch {
+                this.options.signal?.throwIfAborted();
+                return undefined;
+            }
+        };
+        // The release detail carries no name or repository; the directory projection does.
+        const page = await read('/api/v1/resource-releases/?search=' + encodeURIComponent(value.resource_release_uid) + '&limit=100');
+        const row = Array.isArray(page?.results) ? page.results.find((item) => typeof item?.uid === 'string' && item.uid.toLowerCase() === value.resource_release_uid) : undefined;
+        if (row)
+            Object.assign(found, labels({ name: row.name, code_repository_branch_uid: row.code_repository_branch_uid }));
+        const branchUid = found.code_repository_branch_uid ?? value.code_repository_branch_uid;
+        if (branchUid) {
+            const branch = await read('/api/v1/code-repository-branches/' + encodeURIComponent(branchUid) + '/');
+            try {
+                const parsed = (0, repositoryModels_1.codeRepositoryBranchFromResponse)(branch, 'CodeRepositoryBranch response');
+                if (parsed.uid.toLowerCase() === branchUid)
+                    Object.assign(found, labels({ display_name: parsed.code_repository_name, code_repository_branch_uid: branchUid }));
+            }
+            catch { /* an unreadable branch leaves the repository name out */ }
+        }
+        return found;
+    }
+    labelled(value, found) {
+        return connection(value.backend, { ...value, ...found });
+    }
+    /** Optional discovery labels, deduplicated by branch. Never writes connection metadata. */
+    async discoveryNames(rows) {
+        const pending = [...new Set(rows.filter(row => !row.display_name).flatMap(row => row.code_repository_branch_uid ? [row.code_repository_branch_uid] : []))];
+        const names = new Map();
+        await Promise.all(Array.from({ length: Math.min(4, pending.length) }, async () => {
+            while (pending.length) {
+                this.options.signal?.throwIfAborted();
+                const uid = pending.shift();
+                try {
+                    const raw = await this.session.request(rows[0].backend, 'GET', '/api/v1/code-repository-branches/' + uid + '/');
+                    const branch = (0, repositoryModels_1.codeRepositoryBranchFromResponse)(raw, 'CodeRepositoryBranch response');
+                    if (branch.uid.toLowerCase() === uid)
+                        names.set(uid, branch.code_repository_name);
+                }
+                catch (error) {
+                    this.options.signal?.throwIfAborted();
+                    if (error instanceof models_1.ToolingError && error.code === 'CANCELLED')
+                        throw error;
+                    await this.options.checkAccount?.();
+                    // Unavailable optional names must not hide usable endpoints.
+                }
+            }
+        }));
+        return rows.map(row => !row.display_name && row.code_repository_branch_uid && names.has(row.code_repository_branch_uid)
+            ? this.labelled(row, { display_name: names.get(row.code_repository_branch_uid) }) : row);
+    }
+    /** Records saved before labels were stored are completed once, when the backend answers. */
+    async backfill(rows) {
+        const pending = rows.filter(row => !row.display_name);
+        if (!pending.length)
+            return rows;
+        const found = new Map();
+        await Promise.all(Array.from({ length: Math.min(4, pending.length) }, async () => {
+            while (pending.length) {
+                const row = pending.shift();
+                const resolved = await this.resolveLabels(row);
+                const added = Object.entries(resolved).filter(([key, item]) => item !== row[key]);
+                if (added.length)
+                    found.set(row.backend + ' ' + row.resource_release_uid, Object.fromEntries(added));
+            }
+        }));
+        if (!found.size)
+            return rows;
+        const key = (row) => row.backend + ' ' + row.resource_release_uid;
+        const merge = (row) => found.has(key(row)) ? this.labelled(row, { ...found.get(key(row)) }) : row;
+        try {
+            await this.update(all => all.map(merge));
+        }
+        catch (error) {
+            // A held lock or a failed write keeps the listing itself available.
+            if (error instanceof models_1.ToolingError && error.code === 'CANCELLED')
+                throw error;
+            this.options.signal?.throwIfAborted();
+        }
+        return rows.map(merge);
+    }
+    async dispatch(request, inputBackend) {
+        let callStarted = false, resultData;
+        try {
+            const backend = (0, session_1.requireBackend)(inputBackend);
+            this.options.signal?.throwIfAborted();
+            if (request.action === 'mcp-list' && request.readOnly !== undefined && typeof request.readOnly !== 'boolean'
+                || request.action === 'mcp-discover' && request.enrichNames !== undefined && typeof request.enrichNames !== 'boolean') {
+                throw new models_1.ToolingError('INVALID_REQUEST', 'Discovery and listing options must be booleans.');
+            }
+            const environmentUid = request.environmentUid === undefined ? undefined : uuid(request.environmentUid);
+            const belongs = (value) => !environmentUid || value.mcp_connection.organization_environment_uid === environmentUid;
+            const requireEnvironment = (value) => {
+                if (!belongs(value))
+                    throw new models_1.ToolingError('INVALID_REQUEST', 'This MCP belongs to a different organization environment. Select that environment first.');
+            };
+            let data, summary;
+            if (request.action === 'mcp-environments') {
+                data = await (0, environments_1.listEnvironments)(this.session, backend, this.options.signal);
+                summary = 'Organization environments available to your MainSequence account.';
+            }
+            else if (request.action === 'mcp-discover') {
+                if ((request.search !== undefined && typeof request.search !== 'string')
+                    || (request.limit !== undefined && (!Number.isInteger(request.limit) || request.limit < 1 || request.limit > 100))
+                    || (request.offset !== undefined && (!Number.isInteger(request.offset) || request.offset < 0))) {
+                    throw new models_1.ToolingError('INVALID_REQUEST', 'Discovery requires a text search, a limit from 1 to 100, and a nonnegative offset.');
+                }
+                const client = new mcpTransport_1.McpTransport(message => this.session.request(backend, 'POST', '/mcp', message, true));
+                await client.initialize();
+                const query = async (offset, limit) => {
+                    const output = await client.request('tools/call', { name: 'resource_release.mcp_endpoints',
+                        arguments: { ...(request.search !== undefined ? { search: request.search } : {}), limit, offset } });
+                    if (output?.isError)
+                        throw new models_1.ToolingError('API_ERROR', 'Platform MCP could not list available project endpoints.');
+                    const page = output?.structuredContent;
+                    if (!Number.isInteger(page?.count) || page.count < 0 || !Array.isArray(page?.results))
+                        throw new models_1.ToolingError('API_ERROR', 'Platform MCP returned an invalid directory.');
+                    return { count: page.count, results: page.results.map((row) => connection(backend, row)) };
+                };
+                if (!environmentUid)
+                    data = await query(request.offset ?? 0, request.limit ?? 100);
+                else {
+                    // The existing platform MCP has no environment filter. Scan its pages
+                    // before paginating the matching releases; never show an incomplete page as complete.
+                    const matching = new Map();
+                    for (let offset = 0;; offset += 100) {
+                        this.options.signal?.throwIfAborted();
+                        if (offset >= 10000)
+                            throw new models_1.ToolingError('API_ERROR', 'MCP discovery is too large; narrow the search.');
+                        const page = await query(offset, 100);
+                        for (const value of page.results.filter(belongs))
+                            matching.set(value.resource_release_uid, value);
+                        if (offset + 100 >= page.count)
+                            break;
+                    }
+                    const values = [...matching.values()], offset = request.offset ?? 0;
+                    data = { count: values.length, results: values.slice(offset, offset + (request.limit ?? 100)) };
+                }
+                if (request.enrichNames) {
+                    const page = data;
+                    data = { ...page, results: await this.discoveryNames(page.results) };
+                }
+                summary = 'Available project MCP endpoints; discovery does not save a connection.';
+            }
+            else if (request.action === 'mcp-list') {
+                const saved = (await this.read()).filter(row => row.backend === backend && belongs(row));
+                data = request.readOnly ? saved : await this.backfill(saved);
+                summary = 'Saved MCP connections for this backend. Availability is checked when used.';
+            }
+            else {
+                const releaseUid = uuid(request.releaseUid);
+                if (request.action === 'mcp-remove') {
+                    const saved = (await this.read()).find(row => row.backend === backend && row.resource_release_uid === releaseUid);
+                    if (saved)
+                        requireEnvironment(saved);
+                    await this.update(rows => rows.filter(row => !(row.backend === backend && row.resource_release_uid === releaseUid)));
+                    data = { resource_release_uid: releaseUid };
+                    summary = 'The saved connection was removed.';
+                }
+                else {
+                    let value = await this.current(backend, releaseUid);
+                    requireEnvironment(value);
+                    if (request.action !== 'mcp-add') {
+                        const saved = (await this.read()).find(row => row.backend === backend && row.resource_release_uid === releaseUid);
+                        if (!saved)
+                            throw new models_1.ToolingError('INVALID_REQUEST', 'Add this MCP connection before using it.');
+                        if (saved.mcp_connection.url !== value.mcp_connection.url)
+                            throw new models_1.ToolingError('INVALID_REQUEST', 'The MCP endpoint changed. Add the release again to confirm its new endpoint.');
+                        value = this.labelled(value, labels(saved));
+                    }
+                    const client = await this.open(value);
+                    const tools = await client.tools();
+                    if (request.action === 'mcp-add') {
+                        value = this.labelled(value, await this.resolveLabels(value));
+                        await this.update(rows => [...rows.filter(row => !(row.backend === backend && row.resource_release_uid === releaseUid)), value]);
+                        data = { connection: value, tools };
+                        summary = 'MCP connection verified and saved. Its tools can now be used through the plugin.';
+                    }
+                    else if (request.action === 'mcp-tools') {
+                        data = { connection: value, tools };
+                        summary = 'Current tools from the selected MCP.';
+                    }
+                    else if (request.action === 'mcp-call') {
+                        if (typeof request.tool !== 'string' || !tools.some(tool => tool.name === request.tool))
+                            throw new models_1.ToolingError('INVALID_REQUEST', 'The selected tool is absent from the current MCP catalog.');
+                        if (!request.arguments || typeof request.arguments !== 'object' || Array.isArray(request.arguments))
+                            throw new models_1.ToolingError('INVALID_REQUEST', 'Tool arguments must be a JSON object.');
+                        this.options.signal?.throwIfAborted();
+                        callStarted = true;
+                        const output = await client.request('tools/call', { name: request.tool, arguments: request.arguments });
+                        if (!output || !Array.isArray(output.content))
+                            throw new models_1.ToolingError('API_ERROR', 'The MCP tool returned an invalid result.');
+                        resultData = output;
+                        if (output.isError)
+                            throw new models_1.ToolingError('API_ERROR', 'The MCP tool reported an error. Inspect its result before retrying.');
+                        data = output;
+                        summary = 'The MCP tool completed.';
+                    }
+                    else
+                        throw new models_1.ToolingError('INVALID_REQUEST', 'Unknown MCP action.');
+                }
+            }
+            await this.options.checkAccount?.();
+            return this.sanitize({ schemaVersion: 1, action: request.action, status: 'success', summary, data });
+        }
+        catch (error) {
+            const failure = this.options.signal?.aborted ? new models_1.ToolingError('CANCELLED', 'The MCP action was cancelled.')
+                : error instanceof models_1.ToolingError ? error : new models_1.ToolingError('INTERNAL_ERROR', 'The MCP action could not complete.');
+            return this.sanitize({ schemaVersion: 1, action: request.action, status: failure.code === 'CANCELLED' ? 'cancelled' : 'failure',
+                summary: failure.message, error: { code: failure.code, message: failure.message }, ...(resultData === undefined ? {} : { data: resultData }),
+                ...(callStarted ? { effects: { state: 'partial-or-uncertain', message: 'The tool may have changed remote state. No automatic retry was attempted; verify the outcome before repeating it.' } } : {}) });
+        }
+        finally {
+            this.secrets.clear();
+        }
+    }
+}
+exports.McpConnections = McpConnections;

package/dist/vendor/devtools/shared/mcpTransport.js

@@ -0,0 +1,177 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpTransport = void 0;
+exports.readMcpResponse = readMcpResponse;
+exports.sendProjectMcp = sendProjectMcp;
+const models_1 = require("./models.js");
+/** The platform's stateless Streamable HTTP profile; no legacy SSE endpoint. */
+class McpTransport {
+    send;
+    sequence = 0;
+    initialized = false;
+    constructor(send) {
+        this.send = send;
+    }
+    async initialize() {
+        const result = await this.request('initialize', {
+            protocolVersion: '2025-11-25', capabilities: {},
+            clientInfo: { name: 'mainsequence-devtools', version: '0.2.7' },
+        });
+        if (result?.protocolVersion !== '2025-11-25' || !result?.capabilities?.tools) {
+            throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'This endpoint does not support the platform MCP tools profile (2025-11-25).');
+        }
+        await this.send({ jsonrpc: '2.0', method: 'notifications/initialized' });
+        this.initialized = true;
+    }
+    async request(method, params) {
+        if (method !== 'initialize' && !this.initialized)
+            throw new models_1.ToolingError('API_ERROR', 'The MCP connection has not initialized.');
+        const id = ++this.sequence;
+        const response = await this.send({ jsonrpc: '2.0', id, method, params });
+        if (!response || response.jsonrpc !== '2.0' || response.id !== id) {
+            throw new models_1.ToolingError('API_ERROR', 'The MCP endpoint returned an invalid or mismatched response.');
+        }
+        if (response.error)
+            throw new models_1.ToolingError('API_ERROR', 'The MCP endpoint rejected ' + method
+                + (Number.isInteger(response.error.code) ? ' (JSON-RPC ' + response.error.code + ')' : '') + '.');
+        if (!Object.hasOwn(response, 'result'))
+            throw new models_1.ToolingError('API_ERROR', 'The MCP response has no result.');
+        return response.result;
+    }
+    async tools() {
+        const tools = [], cursors = new Set(), names = new Set();
+        let cursor;
+        do {
+            const page = await this.request('tools/list', cursor ? { cursor } : {});
+            if (!Array.isArray(page?.tools))
+                throw new models_1.ToolingError('API_ERROR', 'The MCP tool catalog is invalid.');
+            for (const tool of page.tools) {
+                if (!tool || typeof tool.name !== 'string' || !tool.name || !tool.inputSchema || typeof tool.inputSchema !== 'object' || Array.isArray(tool.inputSchema) || names.has(tool.name)) {
+                    throw new models_1.ToolingError('API_ERROR', 'The MCP tool catalog contains an invalid or duplicate tool.');
+                }
+                const normalized = { ...tool };
+                if (typeof normalized.description !== 'string')
+                    delete normalized.description;
+                for (const field of ['annotations', '_meta'])
+                    if (!normalized[field] || typeof normalized[field] !== 'object' || Array.isArray(normalized[field]))
+                        delete normalized[field];
+                if (normalized.annotations) {
+                    normalized.annotations = { ...normalized.annotations };
+                    for (const flag of ['readOnlyHint', 'destructiveHint', 'idempotentHint', 'openWorldHint']) {
+                        if (typeof normalized.annotations[flag] !== 'boolean')
+                            delete normalized.annotations[flag];
+                    }
+                }
+                names.add(tool.name);
+                tools.push(normalized);
+            }
+            cursor = page.nextCursor;
+            if (cursor !== undefined && (typeof cursor !== 'string' || !cursor || cursors.has(cursor))) {
+                throw new models_1.ToolingError('API_ERROR', 'The MCP tool catalog returned an invalid pagination cursor.');
+            }
+            if (cursor)
+                cursors.add(cursor);
+            if (tools.length > 10_000 || cursors.size > 100)
+                throw new models_1.ToolingError('API_ERROR', 'The MCP tool catalog exceeded the client limit.');
+        } while (cursor);
+        return tools;
+    }
+}
+exports.McpTransport = McpTransport;
+/** Read bounded JSON or POST SSE; never reconnect or replay a tool invocation. */
+async function readMcpResponse(response, message) {
+    if (response.headers.has('mcp-session-id')) {
+        await response.body?.cancel();
+        throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'Stateful MCP sessions are outside the platform profile.');
+    }
+    if (!response.ok) {
+        await response.body?.cancel();
+        throw new models_1.ToolingError(response.status === 401 || response.status === 403 ? 'AUTH_REJECTED' : 'API_ERROR', 'The MCP endpoint returned HTTP ' + response.status + '.');
+    }
+    if (!Object.hasOwn(message, 'id')) {
+        await response.body?.cancel();
+        if (response.status !== 202 && response.status !== 204)
+            throw new models_1.ToolingError('API_ERROR', 'The MCP notification was not acknowledged.');
+        return undefined;
+    }
+    const kind = response.headers.get('content-type')?.split(';')[0].trim();
+    if (kind !== 'application/json' && kind !== 'text/event-stream') {
+        await response.body?.cancel();
+        throw new models_1.ToolingError('API_ERROR', 'The MCP endpoint returned an unsupported content type.');
+    }
+    if (!response.body)
+        throw new models_1.ToolingError('API_ERROR', 'The MCP endpoint returned an empty response.');
+    const reader = response.body.getReader(), decoder = new TextDecoder();
+    let size = 0, text = '';
+    const parse = (raw) => {
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            throw new models_1.ToolingError('API_ERROR', 'The MCP endpoint returned invalid JSON.');
+        }
+    };
+    try {
+        while (true) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            size += part.value.byteLength;
+            if (size > 8_000_000)
+                throw new models_1.ToolingError('API_ERROR', 'The MCP response exceeded the client limit.');
+            text += decoder.decode(part.value, { stream: true });
+            if (kind === 'text/event-stream') {
+                // Normalize CRLF only once both bytes have arrived; chunk boundaries may split them.
+                text = text.replace(/\r\n/g, '\n');
+                let end;
+                while ((end = text.indexOf('\n\n')) >= 0) {
+                    const event = text.slice(0, end);
+                    text = text.slice(end + 2);
+                    const data = event.split('\n').filter(line => line.startsWith('data:')).map(line => line.slice(5).replace(/^ /, '')).join('\n');
+                    if (!data)
+                        continue;
+                    const value = parse(data);
+                    if (value?.id === message.id && !value.method)
+                        return value;
+                    if (value?.method && Object.hasOwn(value, 'id'))
+                        throw new models_1.ToolingError('UNSUPPORTED_ACTION', 'The MCP endpoint requested an unsupported client capability.');
+                    if (value && Object.hasOwn(value, 'id'))
+                        throw new models_1.ToolingError('API_ERROR', 'The MCP stream returned a mismatched response.');
+                }
+            }
+        }
+        text += decoder.decode();
+        if (kind === 'application/json')
+            return parse(text);
+        throw new models_1.ToolingError('API_ERROR', 'The MCP stream ended before the response arrived. The call was not retried.');
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+        reader.releaseLock();
+    }
+}
+async function sendProjectMcp(url, token, message, options) {
+    options.signal?.throwIfAborted();
+    const controller = new AbortController(), abort = () => controller.abort();
+    options.signal?.addEventListener('abort', abort, { once: true });
+    const timer = setTimeout(abort, options.requestTimeoutMs ?? 60_000);
+    try {
+        return await readMcpResponse(await (options.fetch ?? fetch)(url, {
+            method: 'POST', redirect: 'error', signal: controller.signal,
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json, text/event-stream',
+                Authorization: 'Bearer ' + token, 'MCP-Protocol-Version': '2025-11-25' },
+            body: JSON.stringify(message),
+        }), message);
+    }
+    catch (error) {
+        if (options.signal?.aborted)
+            throw new models_1.ToolingError('CANCELLED', 'The MCP request was cancelled. Cancellation does not undo a remote operation.');
+        if (error instanceof models_1.ToolingError)
+            throw error;
+        throw new models_1.ToolingError('BACKEND_UNREACHABLE', 'The MCP request failed or timed out. It was not retried.');
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener('abort', abort);
+    }
+}

package/dist/vendor/devtools/shared/models.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolingError = void 0;
+class ToolingError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ToolingError';
+    }
+}
+exports.ToolingError = ToolingError;