@dev-mainsequence/codex-plugin 0.4.2 → 0.7.10

package/dist/vendor/devtools/shared/arguments.js

@@ -5,6 +5,7 @@ exports.parseArguments = parseArguments;
 exports.tokenizeCommand = tokenizeCommand;
 const node_fs_1 = require("node:fs");
 const models_1 = require("./models.js");
+const workingDirectory_1 = require("./workingDirectory.js");
 exports.HELP = `MainSequence developer tooling (Node 22+)
 
 ms-devtools login|logout|refresh-token|auth-status|repositories [--backend URL]
@@ -13,6 +14,7 @@ ms-devtools mcp-discover [--search TEXT] [--limit N] [--offset N] [--backend URL
 ms-devtools mcp-list [--backend URL]
 ms-devtools mcp-add|mcp-remove|mcp-tools --uid RELEASE_UUID [--backend URL]
 ms-devtools mcp-call --uid RELEASE_UUID --tool NAME [--arguments-file JSON_FILE] [--backend URL]
+ms-devtools mcp-catalog [--refresh] [--backend URL]
 ms-devtools status|resolve [--path ROOT] [--type python|vite_react] [--backend URL]
 ms-devtools sync [--path ROOT]
 ms-devtools sdk-status|update-sdk|update-agents|install-skills|install|env-cleanup [--path ROOT]
@@ -27,13 +29,16 @@ skills-sync requires MainSequence MCP and reports unsupported.
 open-folder and signed-terminal require a host with those native capabilities.
 In Codex desktop, type /ms, select the ms slash-menu entry, then append COMMAND ... .
 The trusted plugin hook executes the selected command before inference.
+mcp-catalog lists the saved connections' tools as hosts register them (ms_<tool>_<hash>) from the
+shared catalog; --refresh re-reads every connection's catalog first. A cold project MCP can take
+over a minute to answer.
 `;
-function parseArguments(argv, cwd = process.cwd()) {
+function parseArguments(argv, cwd) {
     if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h')
         return { json: argv.includes('--json'), help: true };
     const action = argv[0];
     const flags = {};
-    const boolean = new Set(['--json', '--check', '--dry-run', '--install']);
+    const boolean = new Set(['--json', '--check', '--dry-run', '--install', '--refresh']);
     const valued = new Set(['--backend', '--path', '--type', '--uid', '--branch', '--base-dir', '--search', '--limit', '--offset', '--tool', '--arguments-file']);
     for (let i = 1; i < argv.length; i++) {
         const key = argv[i];
@@ -61,16 +66,17 @@ function parseArguments(argv, cwd = process.cwd()) {
         : action === 'mcp-list' ? global
             : ['mcp-add', 'mcp-remove', 'mcp-tools'].includes(action) ? [...global, '--uid']
                 : action === 'mcp-call' ? [...global, '--uid', '--tool', '--arguments-file']
-                    : ['login', 'logout', 'refresh-token', 'repositories'].includes(action) ? global
-                        : action === 'auth-status' ? [...global, '--check']
-                            : action === 'setup' ? [...global, '--uid', '--branch', '--base-dir', '--install']
-                                : [...global, ...project, ...(['update-sdk', 'install-skills'].includes(action) ? ['--dry-run'] : [])];
+                    : action === 'mcp-catalog' ? [...global, '--refresh']
+                        : ['login', 'logout', 'refresh-token', 'repositories'].includes(action) ? global
+                            : action === 'auth-status' ? [...global, '--check']
+                                : action === 'setup' ? [...global, '--uid', '--branch', '--base-dir', '--install']
+                                    : [...global, ...project, ...(['update-sdk', 'install-skills'].includes(action) ? ['--dry-run'] : [])];
     if (Object.keys(flags).some(key => !allowed.includes(key)))
         throw new models_1.ToolingError('INVALID_REQUEST', 'This option does not apply to the selected action.');
     const backend = typeof flags['--backend'] === 'string' ? flags['--backend'] : undefined;
     const common = { backend };
     let request;
-    if (['mcp-discover', 'mcp-list', 'mcp-add', 'mcp-remove', 'mcp-tools', 'mcp-call'].includes(action)) {
+    if (['mcp-discover', 'mcp-list', 'mcp-add', 'mcp-remove', 'mcp-tools', 'mcp-call', 'mcp-catalog'].includes(action)) {
         let args = {};
         if (typeof flags['--arguments-file'] === 'string') {
             try {
@@ -88,7 +94,8 @@ function parseArguments(argv, cwd = process.cwd()) {
             ...(flags['--search'] !== undefined ? { search: flags['--search'] } : {}),
             ...(flags['--limit'] !== undefined ? { limit: Number(flags['--limit']) } : {}),
             ...(flags['--offset'] !== undefined ? { offset: Number(flags['--offset']) } : {}),
-            ...(action === 'mcp-call' ? { tool: flags['--tool'], arguments: args } : {}) };
+            ...(action === 'mcp-call' ? { tool: flags['--tool'], arguments: args } : {}),
+            ...(action === 'mcp-catalog' && flags['--refresh'] ? { refresh: 'force' } : {}) };
     }
     else if (['login', 'logout', 'refresh-token', 'repositories'].includes(action))
         request = { action, ...common };
@@ -97,7 +104,7 @@ function parseArguments(argv, cwd = process.cwd()) {
     else if (action === 'setup')
         request = { action, ...common, repositoryUid: flags['--uid'], branch: flags['--branch'], baseDir: flags['--base-dir'], install: Boolean(flags['--install']) };
     else
-        request = { action, ...common, root: flags['--path'] || cwd, projectType: flags['--type'], dryRun: Boolean(flags['--dry-run']) };
+        request = { action, ...common, root: flags['--path'] || cwd || (0, workingDirectory_1.currentDirectory)(), projectType: flags['--type'], dryRun: Boolean(flags['--dry-run']) };
     return { request, json: Boolean(flags['--json']) };
 }
 /** Tokenize explicit hook commands without evaluating a shell, substitutions, or expansions. */

package/dist/vendor/devtools/shared/deployments.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HIDDEN_DEPLOYMENT = exports.DEPLOYMENT_ACTIONS = void 0;
+exports.workflowRun = workflowRun;
+exports.deploymentRun = deploymentRun;
+exports.createDeployments = createDeployments;
+const models_1 = require("./models.js");
+const session_1 = require("./session.js");
+const accountScope_1 = require("./accountScope.js");
+exports.DEPLOYMENT_ACTIONS = new Set(['deployment-history', 'deployment-run', 'deployment-logs']);
+/** Command Center's wording for a run that answers 404: it never says whether the record exists. */
+exports.HIDDEN_DEPLOYMENT = "You can't see this deployment. A deployment is shown to the people who can see its release or Job.";
+const UUID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i;
+const ACTIVE = new Set(['pending', 'queued', 'running']);
+const RUN_PATH = /^\/api\/v1\/(?:deployment-runs\/[a-f0-9-]{36}\/(?:logs\/)?|deployment-history\/[a-f0-9-]{36}\/)$/;
+function uuid(value, message) {
+    if (typeof value !== 'string' || !UUID.test(value))
+        throw new models_1.ToolingError('INVALID_REQUEST', message);
+    return value.toLowerCase();
+}
+function integer(value, minimum, maximum, fallback, message) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isInteger(value) || value < minimum || value > maximum)
+        throw new models_1.ToolingError('INVALID_REQUEST', message);
+    return value;
+}
+const text = (value, limit = 4000) => typeof value === 'string'
+    ? value.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g, '').slice(0, limit) : '';
+const optionalUuid = (value) => typeof value === 'string' && UUID.test(value) ? value.toLowerCase() : null;
+function when(value) {
+    if (typeof value !== 'string')
+        return null;
+    const time = Date.parse(value);
+    return Number.isFinite(time) ? new Date(time).toISOString() : null;
+}
+function duration(start, end, now) {
+    if (!start)
+        return null;
+    const from = Date.parse(start), to = end ? Date.parse(end) : now;
+    return Number.isFinite(from) && Number.isFinite(to) && to >= from ? to - from : null;
+}
+function errorText(value) {
+    if (!value)
+        return '';
+    if (typeof value === 'string')
+        return text(value, 2000);
+    if (typeof value === 'object') {
+        const row = value;
+        const detail = [row.detail, row.message, row.reason].find(item => typeof item === 'string' && item.trim());
+        const code = typeof row.code === 'string' ? row.code : '';
+        if (detail || code)
+            return text([code, detail].filter(Boolean).join(': '), 2000);
+        try {
+            return text(JSON.stringify(value), 1000);
+        }
+        catch {
+            return 'Error details unavailable.';
+        }
+    }
+    return text(String(value), 500);
+}
+const earliest = (values) => values.filter((value) => !!value).sort()[0] ?? null;
+const latest = (values) => values.filter((value) => !!value).sort().at(-1) ?? null;
+const list = (value) => Array.isArray(value) ? value : [];
+const rec = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+/** An ADR-074 workflow run: the sealed step graph in plan order and the runs it owns. */
+function workflowRun(row, now) {
+    const run = rec(row);
+    const uid = optionalUuid(run.uid);
+    if (!uid)
+        return null;
+    const steps = list(run.steps).slice(0, 60).map(item => {
+        const step = rec(item);
+        const startedAt = when(step.dispatch_started_at) ?? when(step.dispatch_authorized_at), finishedAt = when(step.finished_at);
+        const key = text(step.step_key, 200);
+        return { id: key, key, operation: text(step.operation, 100), resourceKey: text(step.resource_key, 200), state: text(step.state, 40) || 'unknown',
+            reason: text(step.reason, 500), needs: list(step.needs).slice(0, 40).map(need => text(need, 200)), deploymentRunUid: optionalUuid(step.deployment_run_uid),
+            startedAt, finishedAt, durationMs: duration(startedAt, finishedAt, now), error: errorText(step.error) };
+    });
+    const createdAt = when(run.creation_date), finishedAt = when(run.finished_at);
+    const startedAt = earliest([createdAt, ...steps.map(step => step.startedAt)]) ?? createdAt;
+    const deploymentRuns = list(run.deployment_runs).slice(0, 40).flatMap(item => {
+        const owned = rec(item), ownedUid = optionalUuid(owned.uid);
+        return ownedUid ? [{ uid: ownedUid, targetLabel: text(owned.target_label, 200), targetType: text(owned.target_type, 60), state: text(owned.state, 40) || 'unknown',
+                workflowStepKeys: list(owned.workflow_step_keys).slice(0, 40).map(key => text(key, 200)),
+                createdAt: when(owned.created_at), startedAt: when(owned.started_at), finishedAt: when(owned.finished_at) }] : [];
+    });
+    return { kind: 'workflow_run', uid, state: text(run.state, 40) || 'unknown', reason: text(run.reason, 500), workflowPath: text(run.workflow_path, 300),
+        repositoryUid: optionalUuid(run.code_repository_uid), repositoryName: text(run.code_repository_name, 200),
+        branchUid: optionalUuid(run.code_repository_branch_uid), branchName: text(run.repository_branch, 200),
+        commit: text(run.commit_sha, 40).slice(0, 7), createdAt, startedAt, finishedAt: finishedAt ?? (ACTIVE.has(text(run.state, 40)) ? null : latest(steps.map(step => step.finishedAt))),
+        durationMs: duration(startedAt, finishedAt ?? (ACTIVE.has(text(run.state, 40)) ? null : latest(steps.map(step => step.finishedAt))), now),
+        steps, deploymentRuns, error: errorText(run.error) };
+}
+/** A deployment run: its pipeline stages in `sequence` order and, when included, the workflow run that started it. */
+function deploymentRun(row, now) {
+    const run = rec(row);
+    const uid = optionalUuid(run.uid);
+    if (!uid)
+        return null;
+    const target = rec(run.target), repository = rec(target.code_repository), branch = rec(target.code_repository_branch);
+    const steps = list(rec(run.pipeline).steps).map(rec).filter(step => Number.isFinite(Number(step.sequence)))
+        .sort((a, b) => Number(a.sequence) - Number(b.sequence)).slice(0, 60).map(step => {
+        const startedAt = when(step.started_at), finishedAt = when(step.finished_at);
+        const stepUid = optionalUuid(step.uid), key = text(step.key, 200);
+        return { id: stepUid ?? key, uid: stepUid, sequence: Number(step.sequence), key, name: text(step.name, 200), kind: text(step.kind, 60),
+            state: text(step.state, 40) || 'unknown', outcome: text(step.outcome, 100), reason: text(step.reason ?? step.skip_reason, 500),
+            startedAt, finishedAt, durationMs: duration(startedAt, finishedAt, now), error: errorText(step.error) };
+    });
+    const createdAt = when(run.created_at), finishedAt = when(run.finished_at);
+    const startedAt = when(run.started_at) ?? earliest(steps.map(step => step.startedAt)) ?? createdAt;
+    const workflow = run.workflow_run ? workflowRun(run.workflow_run, now) : null;
+    return { kind: 'deployment_run', uid, state: text(run.state, 40) || 'unknown', outcome: text(run.outcome, 100), operation: text(run.operation, 60), source: text(run.source, 60),
+        targetLabel: text(target.display_name || target.name, 200) || text(run.target_type, 60), targetType: text(run.target_type, 60),
+        repositoryUid: optionalUuid(repository.uid), repositoryName: text(repository.name, 200),
+        branchUid: optionalUuid(run.code_repository_branch_uid) ?? optionalUuid(branch.uid), branchName: text(branch.repository_branch, 200),
+        commit: text(run.commit_sha, 40).slice(0, 7), createdAt, startedAt, finishedAt, durationMs: duration(startedAt, finishedAt, now),
+        currentStepKey: text(rec(run.pipeline).current_step_key, 200), steps,
+        workflowStepKeys: list(run.workflow_step_keys).slice(0, 40).map(key => text(key, 200)), workflowRun: workflow,
+        logsAvailable: rec(run.logs).state === 'available' || typeof rec(run.logs).url === 'string', error: errorText(run.error) };
+}
+function historyEntry(row, now) {
+    const kind = rec(row).kind;
+    return kind === 'workflow_run' ? workflowRun(row, now) : kind === 'deployment_run' ? deploymentRun(row, now) : null;
+}
+function logEntry(row) {
+    const entry = rec(row);
+    return { sequence: Number.isFinite(Number(entry.sequence)) ? Number(entry.sequence) : null, timestamp: when(entry.timestamp), stepUid: optionalUuid(entry.step_uid),
+        source: text(entry.source, 100), stream: text(entry.stream, 20), level: text(entry.level, 20), text: text(entry.text, 4000) };
+}
+/** A read-only bridge over the public session service; the saved credentials never leave it. */
+function createDeployments(options) {
+    const transport = options.fetch ?? fetch;
+    const session = (0, session_1.createSessionService)(options.host, { env: options.env, signal: options.signal, requestTimeoutMs: 30_000, sessionLock: options.sessionLock,
+        fetch: async (input, init) => {
+            const response = await transport(input, init);
+            // A run the reader may not see answers 404. Describe it without asserting existence,
+            // adapting only canonical run responses inside the authenticated transport.
+            if (response.status === 404 && RUN_PATH.test(new URL(String(input)).pathname)) {
+                await response.body?.cancel().catch(() => { });
+                return new Response(JSON.stringify({ hidden: true }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+            }
+            return response;
+        } });
+    async function dispatch(input) {
+        const action = input?.action || 'unknown';
+        try {
+            const backend = (0, session_1.requireBackend)(input.backend);
+            const scoped = await (0, accountScope_1.bindSessionAccount)(session, backend, input.expectedAccount);
+            const now = Date.now(), at = new Date(now).toISOString();
+            let data, summary;
+            if (input.action === 'deployment-history') {
+                const environmentUid = uuid(input.environmentUid, 'Choose an organization environment first.');
+                const limit = integer(input.limit, 1, 100, 25, 'Request between 1 and 100 deployment history entries.');
+                const offset = integer(input.offset, 0, 1_000_000, 0, 'The deployment history offset is invalid.');
+                const branchUid = input.codeRepositoryBranchUid === undefined ? '' : uuid(input.codeRepositoryBranchUid, 'Choose a repository branch from the current environment.');
+                const page = await scoped.request(backend, 'GET', `/api/v1/deployment-history/?organization_environment_uid=${environmentUid}&limit=${limit}&offset=${offset}${branchUid ? `&code_repository_branch_uid=${branchUid}` : ''}`);
+                if (!page || !Array.isArray(page.results) || !Number.isInteger(page.count) || page.count < 0)
+                    throw new models_1.ToolingError('API_ERROR', 'The deployment history is unavailable.');
+                const results = page.results.map((row) => historyEntry(row, now)).filter(Boolean);
+                data = { environmentUid, branchUid: branchUid || null, count: page.count, limit, offset, now: at, results };
+                summary = `${page.count} deployment history ${page.count === 1 ? 'entry' : 'entries'}.`;
+            }
+            else if (input.action === 'deployment-run') {
+                const runUid = uuid(input.runUid, 'Choose a deployment or workflow run.');
+                const kind = input.kind === 'workflow_run' ? 'workflow_run' : 'deployment_run';
+                const row = await scoped.request(backend, 'GET', kind === 'workflow_run'
+                    ? `/api/v1/deployment-history/${runUid}/` : `/api/v1/deployment-runs/${runUid}/?include=workflow_run`);
+                if (rec(row).hidden === true) {
+                    data = { hidden: true, uid: runUid, kind, now: at };
+                    summary = exports.HIDDEN_DEPLOYMENT;
+                }
+                else {
+                    const run = kind === 'workflow_run' ? workflowRun(row, now) : deploymentRun(row, now);
+                    if (!run || run.uid !== runUid)
+                        throw new models_1.ToolingError('API_ERROR', 'The deployment run record is unavailable.');
+                    data = { hidden: false, uid: runUid, kind, run, now: at };
+                    summary = `${kind === 'workflow_run' ? 'Workflow run' : 'Deployment'} ${run.state}.`;
+                }
+            }
+            else if (input.action === 'deployment-logs') {
+                const runUid = uuid(input.runUid, 'Choose a deployment run.');
+                const stepUid = input.stepUid === undefined ? '' : uuid(input.stepUid, 'Choose a stage of this deployment run.');
+                const limit = integer(input.limit, 1, 200, 200, 'Request between 1 and 200 log entries.');
+                if (input.cursor !== undefined && (typeof input.cursor !== 'string' || !/^[A-Za-z0-9_.:=~-]{1,4000}$/.test(input.cursor)))
+                    throw new models_1.ToolingError('INVALID_REQUEST', 'Use a log cursor returned by the previous page.');
+                const cursor = input.cursor || '';
+                const page = await scoped.request(backend, 'GET', `/api/v1/deployment-runs/${runUid}/logs/?limit=${limit}${stepUid ? `&step_uid=${stepUid}` : ''}${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ''}`);
+                if (rec(page).hidden === true) {
+                    data = { hidden: true, uid: runUid, now: at };
+                    summary = exports.HIDDEN_DEPLOYMENT;
+                }
+                else {
+                    if (!page || !Array.isArray(page.entries))
+                        throw new models_1.ToolingError('API_ERROR', 'The deployment logs are unavailable.');
+                    const entries = page.entries.slice(0, limit).map(logEntry);
+                    data = { hidden: false, runUid, stepUid: stepUid || null, cursor: cursor || null, nextCursor: typeof page.next_cursor === 'string' && page.next_cursor ? page.next_cursor.slice(0, 4000) : null,
+                        complete: page.complete === true, entries, now: at };
+                    summary = `${entries.length} log ${entries.length === 1 ? 'entry' : 'entries'}.`;
+                }
+            }
+            else
+                throw new models_1.ToolingError('INVALID_REQUEST', 'Unknown deployment action.');
+            await scoped.status(backend, true);
+            return JSON.parse(session.sanitize(JSON.stringify({ schemaVersion: 1, action, status: 'success', summary, data })));
+        }
+        catch (error) {
+            const failure = options.signal?.aborted ? new models_1.ToolingError('CANCELLED', 'The read was cancelled.') : error instanceof models_1.ToolingError ? error : new models_1.ToolingError('API_ERROR', 'Deployment information is unavailable.');
+            return { schemaVersion: 1, action, status: failure.code === 'CANCELLED' ? 'cancelled' : 'failure', summary: failure.message, error: { code: failure.code, message: failure.message } };
+        }
+    }
+    return { dispatch };
+}

package/dist/vendor/devtools/shared/mcp.js

@@ -34,15 +34,36 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.McpConnections = void 0;
+exports.createMcpConnectionCache = createMcpConnectionCache;
 const fs = __importStar(require("node:fs/promises"));
 const path = __importStar(require("node:path"));
-const os = __importStar(require("node:os"));
 const node_crypto_1 = require("node:crypto");
 const models_1 = require("./models.js");
 const session_1 = require("./session.js");
 const mcpTransport_1 = require("./mcpTransport.js");
+const stateDirectory_1 = require("./stateDirectory.js");
+const projectTools_1 = require("./projectTools.js");
 const repositoryModels_1 = require("./repositoryModels.js");
 const environments_1 = require("./environments.js");
+const accountScope_1 = require("./accountScope.js");
+const caches = new WeakMap();
+function createMcpConnectionCache() {
+    const cache = Object.freeze({ kind: 'mainsequence-mcp-cache' });
+    caches.set(cache, new Map());
+    return cache;
+}
+const cacheKey = (backend, uid) => JSON.stringify([backend, uid]);
+const savedIdentity = (value) => JSON.stringify([value.backend, value.resource_release_uid, value.mcp_connection]);
+function credentialExpiry(token) {
+    // This is only a conservative cache lifetime hint; the server verifies the JWT.
+    try {
+        const exp = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString()).exp;
+        return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : 0;
+    }
+    catch {
+        return 0;
+    }
+}
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function uuid(value) {
     if (typeof value !== 'string' || !UUID.test(value)) {
@@ -92,20 +113,21 @@ function connection(backend, row) {
             ...(typeof c.organization_environment_name === 'string' && c.organization_environment_name.trim() ? { organization_environment_name: c.organization_environment_name.trim() } : {}), active_revision_uid: uuid(c.active_revision_uid) } };
 }
 function storagePath(env) {
-    const dir = process.platform === 'darwin' ? path.join(os.homedir(), 'Library', 'Application Support', 'MainSequenceCLI')
-        : process.platform === 'win32' ? path.join(env.APPDATA || os.homedir(), 'MainSequenceCLI') : path.join(os.homedir(), '.config', 'mainsequence');
-    return path.join(dir, 'mcp-connections.json');
+    return path.join((0, stateDirectory_1.mainSequenceStateDirectory)(env), 'mcp-connections.json');
 }
-/** Only endpoint metadata is persisted. Release credentials exist in one invocation's memory. */
+/** Only endpoint metadata is persisted. A bounded runtime may reuse an in-memory grant. */
 class McpConnections {
-    session;
+    originalSession;
     options;
     file;
     secrets = new Set();
-    constructor(session, options = {}) {
-        this.session = session;
+    session;
+    checkAccount;
+    constructor(originalSession, options = {}) {
+        this.originalSession = originalSession;
         this.options = options;
         this.file = options.connectionsPath ?? storagePath(options.env ?? process.env);
+        this.session = originalSession;
     }
     sanitize(value) {
         if (typeof value === 'string') {
@@ -137,7 +159,7 @@ class McpConnections {
     }
     async update(change) {
         this.options.signal?.throwIfAborted();
-        await this.options.checkAccount?.();
+        await this.checkAccount?.();
         await fs.mkdir(path.dirname(this.file), { recursive: true, mode: 0o700 });
         const lock = this.file + '.lock', temporary = this.file + '.' + (0, node_crypto_1.randomUUID)() + '.tmp';
         let handle;
@@ -175,6 +197,16 @@ class McpConnections {
             throw new models_1.ToolingError('API_ERROR', 'The backend returned a different release.');
         return value;
     }
+    get projectTimeoutMs() { return this.options.projectRequestTimeoutMs ?? projectTools_1.DEFAULT_PROJECT_REQUEST_TIMEOUT_MS; }
+    client(value, token, initialized = false) {
+        this.secrets.add(token);
+        return new mcpTransport_1.McpTransport(async (message, request) => {
+            await this.checkAccount?.();
+            const result = await (0, mcpTransport_1.sendProjectMcp)(value.mcp_connection.url, token, message, { fetch: this.options.fetch, signal: this.options.signal, timeoutMs: request?.timeoutMs ?? this.projectTimeoutMs });
+            await this.checkAccount?.();
+            return result;
+        }, initialized);
+    }
     async open(value) {
         const grant = await this.session.request(value.backend, 'GET', '/api/v1/resource-releases/' + value.resource_release_uid + '/exchange-launch/');
         if (grant?.mode !== 'token' || grant.release_kind !== 'fastapi' || typeof grant.token !== 'string' || !grant.token || /[\r\n]/.test(grant.token)) {
@@ -184,14 +216,9 @@ class McpConnections {
         if (new URL(endpoint(grant.rpc_url)).origin !== new URL(value.mcp_connection.url).origin) {
             throw new models_1.ToolingError('API_ERROR', 'The release credential targets a different endpoint.');
         }
-        const client = new mcpTransport_1.McpTransport(async (message) => {
-            await this.options.checkAccount?.();
-            const result = await (0, mcpTransport_1.sendProjectMcp)(value.mcp_connection.url, grant.token, message, this.options);
-            await this.options.checkAccount?.();
-            return result;
-        });
+        const client = this.client(value, grant.token);
         await client.initialize();
-        return client;
+        return { client, token: grant.token, expiresAt: credentialExpiry(grant.token) };
     }
     /** The release's name and repository from the release directory and its branch. Whatever
      * cannot be read is left out: labels never make a working MCP unavailable. */
@@ -244,7 +271,7 @@ class McpConnections {
                     this.options.signal?.throwIfAborted();
                     if (error instanceof models_1.ToolingError && error.code === 'CANCELLED')
                         throw error;
-                    await this.options.checkAccount?.();
+                    await this.checkAccount?.();
                     // Unavailable optional names must not hide usable endpoints.
                 }
             }
@@ -284,9 +311,54 @@ class McpConnections {
     }
     async dispatch(request, inputBackend) {
         let callStarted = false, resultData;
+        let key, reused = false;
+        let retained;
+        const cache = this.options.cache ? caches.get(this.options.cache) : undefined;
         try {
             const backend = (0, session_1.requireBackend)(inputBackend);
             this.options.signal?.throwIfAborted();
+            if (request.action === 'mcp-catalog' || request.action === 'mcp-tool-call')
+                throw new models_1.ToolingError('INVALID_REQUEST', 'mcp-catalog and mcp-tool-call are dispatched by createDevTools(), not by the connection client.');
+            let cached, selected;
+            if ('releaseUid' in request) {
+                key = cacheKey(backend, uuid(request.releaseUid));
+                if (cache && request.action === 'mcp-remove')
+                    cache.delete(key);
+                else if (cache) {
+                    for (const [id, item] of cache)
+                        if (item.expiresAt <= Date.now())
+                            cache.delete(id);
+                    selected = await this.originalSession.selectionIdentity?.(backend);
+                    cached = cache.get(key);
+                    if (cached && (cached.identity !== selected?.key || cached.account !== request.expectedAccount || !['mcp-tools', 'mcp-call'].includes(request.action))) {
+                        cache.delete(key);
+                        cached = undefined;
+                    }
+                    if (cached) {
+                        const saved = (await this.read()).find(row => row.backend === backend && row.resource_release_uid === request.releaseUid);
+                        if (!saved || savedIdentity(saved) !== cached.savedIdentity) {
+                            cache.delete(key);
+                            cached = undefined;
+                        }
+                    }
+                }
+            }
+            reused = Boolean(cached);
+            if (cached) {
+                const identity = cached.identity;
+                this.checkAccount = async () => {
+                    this.options.signal?.throwIfAborted();
+                    if ((await this.originalSession.selectionIdentity?.(backend))?.key !== identity)
+                        throw new models_1.ToolingError('AUTH_REJECTED', 'The shared MainSequence login changed. Refresh the current view.');
+                };
+                await this.checkAccount();
+            }
+            else {
+                this.session = await (0, accountScope_1.bindSessionAccount)(this.originalSession, backend, request.expectedAccount);
+                this.checkAccount = request.expectedAccount === undefined ? undefined : (fresh = false) => this.session.status(backend, fresh).then(() => { });
+                if (cache && key)
+                    selected = await this.originalSession.selectionIdentity?.(backend);
+            }
             if (request.action === 'mcp-list' && request.readOnly !== undefined && typeof request.readOnly !== 'boolean'
                 || request.action === 'mcp-discover' && request.enrichNames !== undefined && typeof request.enrichNames !== 'boolean') {
                 throw new models_1.ToolingError('INVALID_REQUEST', 'Discovery and listing options must be booleans.');
@@ -361,7 +433,8 @@ class McpConnections {
                     summary = 'The saved connection was removed.';
                 }
                 else {
-                    let value = await this.current(backend, releaseUid);
+                    let value = cached?.value ?? await this.current(backend, releaseUid);
+                    let savedSnapshot = savedIdentity(value);
                     requireEnvironment(value);
                     if (request.action !== 'mcp-add') {
                         const saved = (await this.read()).find(row => row.backend === backend && row.resource_release_uid === releaseUid);
@@ -369,10 +442,15 @@ class McpConnections {
                             throw new models_1.ToolingError('INVALID_REQUEST', 'Add this MCP connection before using it.');
                         if (saved.mcp_connection.url !== value.mcp_connection.url)
                             throw new models_1.ToolingError('INVALID_REQUEST', 'The MCP endpoint changed. Add the release again to confirm its new endpoint.');
+                        savedSnapshot = savedIdentity(saved);
                         value = this.labelled(value, labels(saved));
                     }
-                    const client = await this.open(value);
-                    const tools = await client.tools();
+                    const opened = cached ? { client: this.client(value, cached.token, true), token: cached.token, expiresAt: cached.expiresAt } : await this.open(value);
+                    const client = opened.client;
+                    // An explicit catalog read always refreshes tools. A following call reuses it.
+                    let tools = cached && request.action === 'mcp-call' ? cached.tools : await client.tools();
+                    if (cached && request.action === 'mcp-call' && !tools.some(tool => tool.name === request.tool))
+                        tools = await client.tools();
                     if (request.action === 'mcp-add') {
                         value = this.labelled(value, await this.resolveLabels(value));
                         await this.update(rows => [...rows.filter(row => !(row.backend === backend && row.resource_release_uid === releaseUid)), value]);
@@ -390,27 +468,48 @@ class McpConnections {
                             throw new models_1.ToolingError('INVALID_REQUEST', 'Tool arguments must be a JSON object.');
                         this.options.signal?.throwIfAborted();
                         callStarted = true;
-                        const output = await client.request('tools/call', { name: request.tool, arguments: request.arguments });
+                        // A tool that advertises a longer run (`_meta["mainsequence.ai/timeout-seconds/v1"]`) gets it, capped at 300 s.
+                        const output = await client.request('tools/call', { name: request.tool, arguments: request.arguments }, { timeoutMs: (0, projectTools_1.projectToolTimeoutMs)(tools.find(tool => tool.name === request.tool), this.projectTimeoutMs) });
                         if (!output || !Array.isArray(output.content))
                             throw new models_1.ToolingError('API_ERROR', 'The MCP tool returned an invalid result.');
                         resultData = output;
-                        if (output.isError)
-                            throw new models_1.ToolingError('API_ERROR', 'The MCP tool reported an error. Inspect its result before retrying.');
+                        if (output.isError) {
+                            await this.checkAccount?.(!reused);
+                            throw new models_1.ToolingError('MCP_TOOL_ERROR', 'The connected MCP tool returned an error. Its original content and structuredContent are included in the result.');
+                        }
                         data = output;
                         summary = 'The MCP tool completed.';
                     }
                     else
                         throw new models_1.ToolingError('INVALID_REQUEST', 'Unknown MCP action.');
+                    if (cache && key && selected && (await this.originalSession.selectionIdentity?.(backend))?.key === selected.key) {
+                        // Check local selection again before retaining a grant; never extend a lease
+                        // on a warm call. Unknown/expired credential lifetimes are not cached.
+                        // A cold setup may renew the same account while resolving labels or
+                        // checking access. The account-bound checks below remain authoritative;
+                        // skip retaining an old identity instead of failing an already saved connection.
+                        const expiresAt = cached?.expiresAt ?? Math.min(Date.now() + 60_000, opened.expiresAt - 5_000, (selected.expiresAt ?? Infinity) - 5_000);
+                        if (expiresAt > Date.now()) {
+                            retained = { value, token: opened.token, tools, identity: selected.key, account: request.expectedAccount, expiresAt, savedIdentity: savedSnapshot };
+                        }
+                    }
                 }
             }
-            await this.options.checkAccount?.();
+            await this.checkAccount?.(!reused);
+            if (cache && key && retained && retained.expiresAt > Date.now()) {
+                while (cache.size >= 32 && !cache.has(key))
+                    cache.delete(cache.keys().next().value);
+                cache.set(key, retained);
+            }
             return this.sanitize({ schemaVersion: 1, action: request.action, status: 'success', summary, data });
         }
         catch (error) {
             const failure = this.options.signal?.aborted ? new models_1.ToolingError('CANCELLED', 'The MCP action was cancelled.')
                 : error instanceof models_1.ToolingError ? error : new models_1.ToolingError('INTERNAL_ERROR', 'The MCP action could not complete.');
+            if (cache && key && failure.code !== 'MCP_TOOL_ERROR')
+                cache.delete(key);
             return this.sanitize({ schemaVersion: 1, action: request.action, status: failure.code === 'CANCELLED' ? 'cancelled' : 'failure',
-                summary: failure.message, error: { code: failure.code, message: failure.message }, ...(resultData === undefined ? {} : { data: resultData }),
+                summary: failure.message, error: { code: failure.code, message: failure.message }, ...(resultData === undefined || ['AUTH_REJECTED', 'NOT_AUTHENTICATED'].includes(failure.code) ? {} : { data: resultData }),
                 ...(callStarted ? { effects: { state: 'partial-or-uncertain', message: 'The tool may have changed remote state. No automatic retry was attempted; verify the outcome before repeating it.' } } : {}) });
         }
         finally {