@docyrus/docyrus 0.0.29 → 0.0.31

package/server-loader.js

@@ -544,7 +544,7 @@ var init_dist = __esm({
             });
             if (!chunk) {
               if (i === 1) {
-                await new Promise((resolve2) => setTimeout(resolve2));
+                await new Promise((resolve3) => setTimeout(resolve3));
                 maxReadCount = 3;
                 continue;
               }
@@ -692,7 +692,7 @@ var init_dist = __esm({
 // src/server/server-loader.ts
 var import_node_fs = require("node:fs");
 var import_node_url = require("node:url");
-var import_node_path4 = require("node:path");
+var import_node_path6 = require("node:path");
 var import_picocolors2 = __toESM(require_picocolors());
 
 // src/agent/envStore.ts
@@ -795,9 +795,9 @@ var AgentEnvStore = class {
 
 // src/server/agentServer.ts
 var import_node_child_process = require("node:child_process");
-var import_node_crypto2 = require("node:crypto");
-var import_promises3 = require("node:fs/promises");
-var import_node_path3 = require("node:path");
+var import_node_crypto3 = require("node:crypto");
+var import_promises5 = require("node:fs/promises");
+var import_node_path5 = require("node:path");
 
 // ../../node_modules/.pnpm/hono@4.12.8/node_modules/hono/dist/compose.js
 var compose = (middleware, onError, onNotFound) => {
@@ -4050,8 +4050,8 @@ var OAuthFlowManager = class {
     if (state.currentStep) {
       return Promise.resolve(state.currentStep);
     }
-    return new Promise((resolve2) => {
-      state.waitingForStep = { resolve: resolve2 };
+    return new Promise((resolve3) => {
+      state.waitingForStep = { resolve: resolve3 };
     });
   }
   async start(params) {
@@ -4072,8 +4072,8 @@ var OAuthFlowManager = class {
       onPrompt: async (prompt) => {
         const step = buildPromptStep({ state, type: "prompt", prompt });
         this.emitStep(state, step);
-        return await new Promise((resolve2) => {
-          state.pendingInput = { type: "prompt", resolve: resolve2 };
+        return await new Promise((resolve3) => {
+          state.pendingInput = { type: "prompt", resolve: resolve3 };
         });
       },
       onManualCodeInput: async () => {
@@ -4085,8 +4085,8 @@ var OAuthFlowManager = class {
           }
         });
         this.emitStep(state, step);
-        return await new Promise((resolve2) => {
-          state.pendingInput = { type: "manual-code", resolve: resolve2 };
+        return await new Promise((resolve3) => {
+          state.pendingInput = { type: "manual-code", resolve: resolve3 };
         });
       },
       onProgress: (_message) => {
@@ -4128,6 +4128,535 @@ var OAuthFlowManager = class {
   }
 };
 
+// src/server/mcpConfigService.ts
+var import_node_crypto2 = require("node:crypto");
+var import_promises3 = require("node:fs/promises");
+var import_node_os = require("node:os");
+var import_node_path3 = require("node:path");
+var PROJECT_CONFIG_NAME = ".pi/mcp.json";
+var IMPORT_PATHS = {
+  "cursor": (0, import_node_path3.join)((0, import_node_os.homedir)(), ".cursor", "mcp.json"),
+  "claude-code": (0, import_node_path3.join)((0, import_node_os.homedir)(), ".claude", "claude_desktop_config.json"),
+  "claude-desktop": (0, import_node_path3.join)((0, import_node_os.homedir)(), "Library", "Application Support", "Claude", "claude_desktop_config.json"),
+  "codex": (0, import_node_path3.join)((0, import_node_os.homedir)(), ".codex", "config.json"),
+  "windsurf": (0, import_node_path3.join)((0, import_node_os.homedir)(), ".windsurf", "mcp.json"),
+  "vscode": ".vscode/mcp.json"
+};
+function getMcpConfigPath(agentDir) {
+  return (0, import_node_path3.join)(agentDir, "mcp.json");
+}
+function getMcpCachePath(agentDir) {
+  return (0, import_node_path3.join)(agentDir, "mcp-cache.json");
+}
+var SERVER_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
+function validateServerName(name) {
+  if (!name || typeof name !== "string") {
+    return { ok: false, error: "Server name is required" };
+  }
+  if (!SERVER_NAME_REGEX.test(name)) {
+    return { ok: false, error: "Server name must start with alphanumeric and contain only alphanumeric, hyphens, and underscores" };
+  }
+  return { ok: true };
+}
+function validateServerEntry(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    return { ok: false, error: "Server entry must be an object" };
+  }
+  const obj = entry;
+  const hasCommand = typeof obj.command === "string" && obj.command.length > 0;
+  const hasUrl = typeof obj.url === "string" && obj.url.length > 0;
+  if (!hasCommand && !hasUrl) {
+    return { ok: false, error: "Server entry must have either 'command' (stdio) or 'url' (http)" };
+  }
+  if (obj.lifecycle !== void 0) {
+    if (!["keep-alive", "lazy", "eager"].includes(obj.lifecycle)) {
+      return { ok: false, error: "lifecycle must be 'keep-alive', 'lazy', or 'eager'" };
+    }
+  }
+  if (obj.auth !== void 0) {
+    if (!["oauth", "bearer"].includes(obj.auth)) {
+      return { ok: false, error: "auth must be 'oauth' or 'bearer'" };
+    }
+  }
+  if (obj.args !== void 0) {
+    if (!Array.isArray(obj.args) || !obj.args.every((a) => typeof a === "string")) {
+      return { ok: false, error: "args must be an array of strings" };
+    }
+  }
+  if (obj.env !== void 0) {
+    if (!isStringRecord(obj.env)) {
+      return { ok: false, error: "env must be a Record<string, string>" };
+    }
+  }
+  if (obj.headers !== void 0) {
+    if (!isStringRecord(obj.headers)) {
+      return { ok: false, error: "headers must be a Record<string, string>" };
+    }
+  }
+  return { ok: true, value: obj };
+}
+function isStringRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return false;
+  }
+  return Object.values(value).every((v) => typeof v === "string");
+}
+function detectTransport(entry) {
+  return entry.url ? "http" : "stdio";
+}
+function redactSensitiveFields(entry) {
+  const copy = { ...entry };
+  if (copy.bearerToken) {
+    copy.bearerToken = copy.bearerToken.slice(0, 4) + "****";
+  }
+  if (copy.env) {
+    const redactedEnv = { ...copy.env };
+    for (const key of Object.keys(redactedEnv)) {
+      const lower = key.toLowerCase();
+      if (lower.includes("token") || lower.includes("secret") || lower.includes("key") || lower.includes("password")) {
+        const val = redactedEnv[key];
+        redactedEnv[key] = val.length > 4 ? val.slice(0, 4) + "****" : "****";
+      }
+    }
+    copy.env = redactedEnv;
+  }
+  return copy;
+}
+function parseConfigFile(raw2) {
+  if (!raw2 || typeof raw2 !== "object") {
+    return { mcpServers: {} };
+  }
+  const obj = raw2;
+  const servers = obj.mcpServers ?? obj["mcp-servers"] ?? {};
+  if (typeof servers !== "object" || servers === null || Array.isArray(servers)) {
+    return { mcpServers: {} };
+  }
+  return {
+    mcpServers: servers,
+    imports: Array.isArray(obj.imports) ? obj.imports : void 0,
+    settings: obj.settings
+  };
+}
+function extractServers(config, kind) {
+  if (!config || typeof config !== "object") {
+    return {};
+  }
+  const obj = config;
+  let servers;
+  switch (kind) {
+    case "claude-desktop":
+    case "claude-code":
+    case "codex":
+      servers = obj.mcpServers;
+      break;
+    case "cursor":
+    case "windsurf":
+    case "vscode":
+      servers = obj.mcpServers ?? obj["mcp-servers"];
+      break;
+    default:
+      return {};
+  }
+  if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+    return {};
+  }
+  return servers;
+}
+async function readJsonFile(filePath) {
+  try {
+    const content = await (0, import_promises3.readFile)(filePath, "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+async function loadMcpServerConfig(agentDir, cwd) {
+  const configPath = getMcpConfigPath(agentDir);
+  let config = { mcpServers: {} };
+  const raw2 = await readJsonFile(configPath);
+  if (raw2) {
+    config = parseConfigFile(raw2);
+  }
+  if (config.imports?.length) {
+    for (const importKind of config.imports) {
+      const importPath = IMPORT_PATHS[importKind];
+      if (!importPath) {
+        continue;
+      }
+      const fullPath = importPath.startsWith(".") ? (0, import_node_path3.resolve)(cwd, importPath) : importPath;
+      const imported = await readJsonFile(fullPath);
+      if (!imported) {
+        continue;
+      }
+      const servers = extractServers(imported, importKind);
+      for (const [name, def] of Object.entries(servers)) {
+        if (!config.mcpServers[name]) {
+          config.mcpServers[name] = def;
+        }
+      }
+    }
+  }
+  const projectPath = (0, import_node_path3.resolve)(cwd, PROJECT_CONFIG_NAME);
+  if (projectPath !== configPath) {
+    const projectRaw = await readJsonFile(projectPath);
+    if (projectRaw) {
+      const validated = parseConfigFile(projectRaw);
+      config.mcpServers = { ...config.mcpServers, ...validated.mcpServers };
+      if (validated.settings) {
+        config.settings = { ...config.settings, ...validated.settings };
+      }
+    }
+  }
+  return config;
+}
+var CACHE_VERSION = 1;
+var CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+async function loadMcpServerCache(agentDir) {
+  const cachePath = getMcpCachePath(agentDir);
+  const raw2 = await readJsonFile(cachePath);
+  if (!raw2 || typeof raw2 !== "object") {
+    return null;
+  }
+  const obj = raw2;
+  if (obj.version !== CACHE_VERSION) {
+    return null;
+  }
+  if (!obj.servers || typeof obj.servers !== "object") {
+    return null;
+  }
+  return raw2;
+}
+function computeServerHash(definition) {
+  const identity = {
+    command: definition.command,
+    args: definition.args,
+    env: definition.env,
+    cwd: definition.cwd,
+    url: definition.url,
+    headers: definition.headers,
+    auth: definition.auth,
+    bearerToken: definition.bearerToken,
+    bearerTokenEnv: definition.bearerTokenEnv,
+    exposeResources: definition.exposeResources
+  };
+  const normalized = stableStringify(identity);
+  return (0, import_node_crypto2.createHash)("sha256").update(normalized).digest("hex");
+}
+function isServerCacheValid(entry, definition, maxAgeMs = CACHE_MAX_AGE_MS) {
+  if (!entry || entry.configHash !== computeServerHash(definition)) {
+    return false;
+  }
+  if (!entry.cachedAt || typeof entry.cachedAt !== "number") {
+    return false;
+  }
+  if (maxAgeMs > 0 && Date.now() - entry.cachedAt > maxAgeMs) {
+    return false;
+  }
+  return true;
+}
+function stableStringify(value) {
+  if (value === null || value === void 0 || typeof value !== "object") {
+    const serialized = JSON.stringify(value);
+    return serialized === void 0 ? "undefined" : serialized;
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((v) => stableStringify(v)).join(",")}]`;
+  }
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${stableStringify(obj[k])}`).join(",")}}`;
+}
+async function getServerProvenance(agentDir, cwd) {
+  const provenance = /* @__PURE__ */ new Map();
+  const userPath = getMcpConfigPath(agentDir);
+  const userRaw = await readJsonFile(userPath);
+  const userConfig = userRaw ? parseConfigFile(userRaw) : { mcpServers: {} };
+  for (const name of Object.keys(userConfig.mcpServers)) {
+    provenance.set(name, { path: userPath, kind: "user" });
+  }
+  if (userConfig.imports?.length) {
+    for (const importKind of userConfig.imports) {
+      const importPath = IMPORT_PATHS[importKind];
+      if (!importPath) {
+        continue;
+      }
+      const fullPath = importPath.startsWith(".") ? (0, import_node_path3.resolve)(cwd, importPath) : importPath;
+      const imported = await readJsonFile(fullPath);
+      if (!imported) {
+        continue;
+      }
+      const servers = extractServers(imported, importKind);
+      for (const name of Object.keys(servers)) {
+        if (!provenance.has(name)) {
+          provenance.set(name, { path: userPath, kind: "import", importKind });
+        }
+      }
+    }
+  }
+  const projectPath = (0, import_node_path3.resolve)(cwd, PROJECT_CONFIG_NAME);
+  if (projectPath !== userPath) {
+    const projectRaw = await readJsonFile(projectPath);
+    if (projectRaw) {
+      const projectConfig = parseConfigFile(projectRaw);
+      for (const name of Object.keys(projectConfig.mcpServers)) {
+        provenance.set(name, { path: projectPath, kind: "project" });
+      }
+    }
+  }
+  return provenance;
+}
+async function readUserConfig(agentDir) {
+  const configPath = getMcpConfigPath(agentDir);
+  let raw2 = {};
+  const parsed = await readJsonFile(configPath);
+  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+    raw2 = parsed;
+  }
+  const config = parseConfigFile(raw2);
+  return { raw: raw2, config };
+}
+async function writeUserConfig(agentDir, raw2) {
+  const configPath = getMcpConfigPath(agentDir);
+  await (0, import_promises3.mkdir)((0, import_node_path3.dirname)(configPath), { recursive: true });
+  const tmpPath = `${configPath}.${process.pid}.tmp`;
+  await (0, import_promises3.writeFile)(tmpPath, JSON.stringify(raw2, null, 2) + "\n", "utf-8");
+  await (0, import_promises3.rename)(tmpPath, configPath);
+}
+async function addMcpServer(agentDir, name, entry) {
+  const { raw: raw2, config } = await readUserConfig(agentDir);
+  if (config.mcpServers[name]) {
+    throw new Error(`Server "${name}" already exists`);
+  }
+  const servers = raw2.mcpServers ?? raw2["mcp-servers"] ?? {};
+  const key = raw2["mcp-servers"] && !raw2.mcpServers ? "mcp-servers" : "mcpServers";
+  servers[name] = entry;
+  raw2[key] = servers;
+  await writeUserConfig(agentDir, raw2);
+}
+async function updateMcpServer(agentDir, name, entry) {
+  const { raw: raw2 } = await readUserConfig(agentDir);
+  const servers = raw2.mcpServers ?? raw2["mcp-servers"] ?? {};
+  const key = raw2["mcp-servers"] && !raw2.mcpServers ? "mcp-servers" : "mcpServers";
+  if (!servers[name]) {
+    throw new Error(`Server "${name}" not found in user config`);
+  }
+  servers[name] = entry;
+  raw2[key] = servers;
+  await writeUserConfig(agentDir, raw2);
+}
+async function removeMcpServer(agentDir, name) {
+  const { raw: raw2 } = await readUserConfig(agentDir);
+  const servers = raw2.mcpServers ?? raw2["mcp-servers"] ?? {};
+  const key = raw2["mcp-servers"] && !raw2.mcpServers ? "mcp-servers" : "mcpServers";
+  if (!servers[name]) {
+    throw new Error(`Server "${name}" not found in user config`);
+  }
+  delete servers[name];
+  raw2[key] = servers;
+  await writeUserConfig(agentDir, raw2);
+}
+function getServerPrefix(serverName, mode) {
+  if (mode === "none") {
+    return "";
+  }
+  if (mode === "short") {
+    let short = serverName.replace(/-?mcp$/i, "").replace(/-/g, "_");
+    if (!short) {
+      short = "mcp";
+    }
+    return short;
+  }
+  return serverName.replace(/-/g, "_");
+}
+function formatToolName(toolName, serverName, prefix) {
+  const p = getServerPrefix(serverName, prefix);
+  return p ? `${p}_${toolName}` : toolName;
+}
+
+// src/server/skillsService.ts
+var import_promises4 = require("node:fs/promises");
+var import_node_path4 = require("node:path");
+function parseFrontmatter(content) {
+  const frontmatter = {};
+  if (!content.startsWith("---")) {
+    return { frontmatter, body: content };
+  }
+  const endIndex = content.indexOf("\n---", 3);
+  if (endIndex === -1) {
+    return { frontmatter, body: content };
+  }
+  const fmBlock = content.slice(4, endIndex);
+  for (const line of fmBlock.split("\n")) {
+    const colonIndex = line.indexOf(":");
+    if (colonIndex <= 0) {
+      continue;
+    }
+    const key = line.slice(0, colonIndex).trim();
+    const value = line.slice(colonIndex + 1).trim();
+    if (key) {
+      frontmatter[key] = value;
+    }
+  }
+  const body = content.slice(endIndex + 4).trimStart();
+  return { frontmatter, body };
+}
+async function dirExists(path) {
+  try {
+    const s = await (0, import_promises4.stat)(path);
+    return s.isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function listSkills(agentDir) {
+  const skillsDir = (0, import_node_path4.join)(agentDir, "skills");
+  let entries;
+  try {
+    entries = await (0, import_promises4.readdir)(skillsDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const skills = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const skillDir = (0, import_node_path4.join)(skillsDir, entry.name);
+    const skillMdPath = (0, import_node_path4.join)(skillDir, "SKILL.md");
+    let content;
+    try {
+      content = await (0, import_promises4.readFile)(skillMdPath, "utf-8");
+    } catch {
+      continue;
+    }
+    const parsed = parseFrontmatter(content);
+    const hasReferences = await dirExists((0, import_node_path4.join)(skillDir, "references"));
+    skills.push({
+      name: parsed.frontmatter.name || entry.name,
+      description: parsed.frontmatter.description || null,
+      directory: entry.name,
+      hasReferences,
+      userInvocable: parsed.frontmatter["user-invocable"] === "true",
+      frontmatter: parsed.frontmatter
+    });
+  }
+  return skills.sort((a, b) => a.name.localeCompare(b.name));
+}
+async function getSkillDetail(agentDir, skillName) {
+  const skillsDir = (0, import_node_path4.join)(agentDir, "skills");
+  let entries;
+  try {
+    entries = await (0, import_promises4.readdir)(skillsDir, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const skillDir = (0, import_node_path4.join)(skillsDir, entry.name);
+    const skillMdPath = (0, import_node_path4.join)(skillDir, "SKILL.md");
+    let content;
+    try {
+      content = await (0, import_promises4.readFile)(skillMdPath, "utf-8");
+    } catch {
+      continue;
+    }
+    const parsed = parseFrontmatter(content);
+    const fmName = parsed.frontmatter.name || entry.name;
+    if (entry.name === skillName || fmName === skillName) {
+      const hasReferences = await dirExists((0, import_node_path4.join)(skillDir, "references"));
+      return {
+        skill: {
+          name: fmName,
+          description: parsed.frontmatter.description || null,
+          directory: entry.name,
+          hasReferences,
+          userInvocable: parsed.frontmatter["user-invocable"] === "true",
+          frontmatter: parsed.frontmatter
+        },
+        content
+      };
+    }
+  }
+  return null;
+}
+
+// src/server/toolsService.ts
+var BUILT_IN_TOOLS = {
+  agent: [
+    { name: "read", description: "Read file contents" },
+    { name: "bash", description: "Execute shell commands" },
+    { name: "grep", description: "Search file contents" },
+    { name: "find", description: "Find files by name pattern" },
+    { name: "ls", description: "List directory contents" }
+  ],
+  coder: [
+    { name: "read", description: "Read file contents" },
+    { name: "bash", description: "Execute shell commands" },
+    { name: "edit", description: "Edit file contents" },
+    { name: "write", description: "Write file contents" },
+    { name: "grep", description: "Search file contents" },
+    { name: "find", description: "Find files by name pattern" },
+    { name: "ls", description: "List directory contents" }
+  ]
+};
+async function listAllTools(params) {
+  const { profile, agentDir, cwd } = params;
+  const tools = [];
+  const builtIn = BUILT_IN_TOOLS[profile] ?? BUILT_IN_TOOLS.coder;
+  for (const tool of builtIn) {
+    tools.push({
+      name: tool.name,
+      description: tool.description,
+      source: "built-in"
+    });
+  }
+  let config;
+  let cache;
+  try {
+    [config, cache] = await Promise.all([
+      loadMcpServerConfig(agentDir, cwd),
+      loadMcpServerCache(agentDir)
+    ]);
+  } catch {
+    return tools;
+  }
+  const serverNames = Object.keys(config.mcpServers);
+  if (serverNames.length === 0) {
+    return tools;
+  }
+  tools.push({
+    name: "mcp",
+    description: "Call an MCP server tool",
+    source: "built-in"
+  });
+  if (!cache) {
+    return tools;
+  }
+  const prefix = config.settings?.toolPrefix ?? "server";
+  for (const serverName of serverNames) {
+    const serverCache = cache.servers[serverName];
+    if (!serverCache) {
+      continue;
+    }
+    for (const tool of serverCache.tools ?? []) {
+      if (!tool?.name) {
+        continue;
+      }
+      tools.push({
+        name: formatToolName(tool.name, serverName, prefix),
+        description: tool.description ?? null,
+        source: `mcp:${serverName}`,
+        serverName,
+        originalName: tool.name,
+        inputSchema: tool.inputSchema
+      });
+    }
+  }
+  return tools;
+}
+
 // src/server/agentServer.ts
 function generateMessageId() {
   return `msg_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
@@ -4185,7 +4714,7 @@ async function waitForIdle(session, timeoutMs = 3e4) {
   if (!session.isStreaming) {
     return;
   }
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const timer = setTimeout(() => {
       unsubscribe();
       reject(new Error("Timed out waiting for session to become idle"));
@@ -4194,13 +4723,13 @@ async function waitForIdle(session, timeoutMs = 3e4) {
       if (event.type === "agent_end") {
         clearTimeout(timer);
         unsubscribe();
-        resolve2();
+        resolve3();
       }
     });
     if (!session.isStreaming) {
       clearTimeout(timer);
       unsubscribe();
-      resolve2();
+      resolve3();
     }
   });
 }
@@ -4312,8 +4841,8 @@ var FS_IGNORE = /* @__PURE__ */ new Set([
   ".svelte-kit"
 ]);
 function resolveSafePath(cwd, requestPath) {
-  const resolved = (0, import_node_path3.resolve)(cwd, requestPath);
-  const normalizedCwd = cwd.endsWith(import_node_path3.sep) ? cwd : cwd + import_node_path3.sep;
+  const resolved = (0, import_node_path5.resolve)(cwd, requestPath);
+  const normalizedCwd = cwd.endsWith(import_node_path5.sep) ? cwd : cwd + import_node_path5.sep;
   if (resolved !== cwd && !resolved.startsWith(normalizedCwd)) {
     throw new Error("Path escapes working directory");
   }
@@ -4330,7 +4859,7 @@ async function buildTree(params) {
   }
   let entries;
   try {
-    entries = await (0, import_promises3.readdir)(dir, { withFileTypes: true });
+    entries = await (0, import_promises5.readdir)(dir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -4350,8 +4879,8 @@ async function buildTree(params) {
     if (ignore.has(entry.name)) {
       continue;
     }
-    const fullPath = (0, import_node_path3.join)(dir, entry.name);
-    const relativePath = (0, import_node_path3.relative)(cwd, fullPath);
+    const fullPath = (0, import_node_path5.join)(dir, entry.name);
+    const relativePath = (0, import_node_path5.relative)(cwd, fullPath);
     if (entry.isDirectory()) {
       const children = await buildTree({
         dir: fullPath,
@@ -4377,7 +4906,7 @@ async function walkFiles(params) {
   }
   let entries;
   try {
-    entries = await (0, import_promises3.readdir)(dir, { withFileTypes: true });
+    entries = await (0, import_promises5.readdir)(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -4388,8 +4917,8 @@ async function walkFiles(params) {
     if (ignore.has(entry.name)) {
       continue;
     }
-    const fullPath = (0, import_node_path3.join)(dir, entry.name);
-    const relativePath = (0, import_node_path3.relative)(cwd, fullPath);
+    const fullPath = (0, import_node_path5.join)(dir, entry.name);
+    const relativePath = (0, import_node_path5.relative)(cwd, fullPath);
     if (entry.isDirectory()) {
       await walkFiles({ dir: fullPath, cwd, pattern, ignore, maxResults, results });
     } else if (entry.isFile() && pattern.test(relativePath)) {
@@ -4830,11 +5359,11 @@ async function createAgentServer(params) {
     }
     try {
       const resolved = resolveSafePath(context.cwd, filePath);
-      const fileStat = await (0, import_promises3.stat)(resolved);
+      const fileStat = await (0, import_promises5.stat)(resolved);
       if (!fileStat.isFile()) {
         return c.json({ error: "Path is not a file" }, 400);
       }
-      const content = await (0, import_promises3.readFile)(resolved, "utf-8");
+      const content = await (0, import_promises5.readFile)(resolved, "utf-8");
       return c.json({
         path: filePath,
         content,
@@ -4854,9 +5383,9 @@ async function createAgentServer(params) {
     }
     try {
       const resolved = resolveSafePath(context.cwd, body.path);
-      await (0, import_promises3.mkdir)((0, import_node_path3.join)(resolved, ".."), { recursive: true });
-      await (0, import_promises3.writeFile)(resolved, body.content, "utf-8");
-      const fileStat = await (0, import_promises3.stat)(resolved);
+      await (0, import_promises5.mkdir)((0, import_node_path5.join)(resolved, ".."), { recursive: true });
+      await (0, import_promises5.writeFile)(resolved, body.content, "utf-8");
+      const fileStat = await (0, import_promises5.stat)(resolved);
       return c.json({ ok: true, path: body.path, size: fileStat.size });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
@@ -4870,7 +5399,7 @@ async function createAgentServer(params) {
     }
     try {
       const resolved = resolveSafePath(context.cwd, body.path);
-      await (0, import_promises3.mkdir)(resolved, { recursive: true });
+      await (0, import_promises5.mkdir)(resolved, { recursive: true });
       return c.json({ ok: true, path: body.path });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
@@ -4885,8 +5414,8 @@ async function createAgentServer(params) {
     try {
       const resolvedFrom = resolveSafePath(context.cwd, body.from);
       const resolvedTo = resolveSafePath(context.cwd, body.to);
-      await (0, import_promises3.mkdir)((0, import_node_path3.join)(resolvedTo, ".."), { recursive: true });
-      await (0, import_promises3.rename)(resolvedFrom, resolvedTo);
+      await (0, import_promises5.mkdir)((0, import_node_path5.join)(resolvedTo, ".."), { recursive: true });
+      await (0, import_promises5.rename)(resolvedFrom, resolvedTo);
       return c.json({ ok: true, from: body.from, to: body.to });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
@@ -4904,8 +5433,8 @@ async function createAgentServer(params) {
       if (resolved === context.cwd) {
         return c.json({ error: "Cannot delete working directory" }, 400);
       }
-      const fileStat = await (0, import_promises3.stat)(resolved);
-      await (0, import_promises3.rm)(resolved, { recursive: fileStat.isDirectory() });
+      const fileStat = await (0, import_promises5.stat)(resolved);
+      await (0, import_promises5.rm)(resolved, { recursive: fileStat.isDirectory() });
       return c.json({ ok: true, path: filePath });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
@@ -4914,7 +5443,7 @@ async function createAgentServer(params) {
     }
   });
   const CLI_EXEC = process.env.DOCYRUS_CLI_EXECUTABLE || process.execPath;
-  const CLI_ENTRY = process.env.DOCYRUS_CLI_ENTRY || (0, import_node_path3.resolve)(process.argv[1] ? (0, import_node_path3.join)(process.argv[1], "..") : __dirname, "main.js");
+  const CLI_ENTRY = process.env.DOCYRUS_CLI_ENTRY || (0, import_node_path5.resolve)(process.argv[1] ? (0, import_node_path5.join)(process.argv[1], "..") : __dirname, "main.js");
   const CLI_SCOPE = process.env.DOCYRUS_CLI_SCOPE;
   const CLI_TIMEOUT_MS = 3e4;
   function runCliCommand(args) {
@@ -4964,7 +5493,7 @@ async function createAgentServer(params) {
   }
   async function detectDevPort(cwd) {
     try {
-      const pkg = JSON.parse(await (0, import_promises3.readFile)((0, import_node_path3.join)(cwd, "package.json"), "utf-8"));
+      const pkg = JSON.parse(await (0, import_promises5.readFile)((0, import_node_path5.join)(cwd, "package.json"), "utf-8"));
       const devScript = pkg.scripts?.dev;
       if (devScript) {
         const portFlag = devScript.match(/--port\s+(\d+)/);
@@ -4980,7 +5509,7 @@ async function createAgentServer(params) {
     }
     for (const name of ["vite.config.ts", "vite.config.mts", "vite.config.js"]) {
       try {
-        const content = await (0, import_promises3.readFile)((0, import_node_path3.join)(cwd, name), "utf-8");
+        const content = await (0, import_promises5.readFile)((0, import_node_path5.join)(cwd, name), "utf-8");
         const portMatch = content.match(/port\s*:\s*(\d+)/);
         if (portMatch) {
           return Number(portMatch[1]);
@@ -4990,19 +5519,19 @@ async function createAgentServer(params) {
     }
     for (const name of ["next.config.ts", "next.config.mts", "next.config.js", "next.config.mjs"]) {
       try {
-        await (0, import_promises3.stat)((0, import_node_path3.join)(cwd, name));
+        await (0, import_promises5.stat)((0, import_node_path5.join)(cwd, name));
         return 3e3;
       } catch {
       }
     }
     try {
-      await (0, import_promises3.stat)((0, import_node_path3.join)(cwd, "angular.json"));
+      await (0, import_promises5.stat)((0, import_node_path5.join)(cwd, "angular.json"));
       return 4200;
     } catch {
     }
     for (const name of ["nuxt.config.ts", "nuxt.config.js"]) {
       try {
-        await (0, import_promises3.stat)((0, import_node_path3.join)(cwd, name));
+        await (0, import_promises5.stat)((0, import_node_path5.join)(cwd, name));
         return 3e3;
       } catch {
       }
@@ -5032,14 +5561,14 @@ async function createAgentServer(params) {
     } catch {
     }
     try {
-      const pkg = JSON.parse(await (0, import_promises3.readFile)((0, import_node_path3.join)(cwd, "package.json"), "utf-8"));
+      const pkg = JSON.parse(await (0, import_promises5.readFile)((0, import_node_path5.join)(cwd, "package.json"), "utf-8"));
       packageName = pkg.name ?? null;
       packageVersion = pkg.version ?? null;
     } catch {
     }
     cachedProjectInfo = {
       path: cwd,
-      folder: (0, import_node_path3.basename)(cwd),
+      folder: (0, import_node_path5.basename)(cwd),
       repo,
       packageName,
       packageVersion
@@ -5250,8 +5779,8 @@ async function createAgentServer(params) {
         }
         if (entry.status !== "deleted") {
           try {
-            const resolved = (0, import_node_path3.resolve)(cwd, entry.path);
-            const buf = await (0, import_promises3.readFile)(resolved);
+            const resolved = (0, import_node_path5.resolve)(cwd, entry.path);
+            const buf = await (0, import_promises5.readFile)(resolved);
             if (buf.subarray(0, 8192).includes(0)) {
               return null;
             }
@@ -5288,6 +5817,185 @@ async function createAgentServer(params) {
       return c.json({ error: message }, 500);
     }
   });
+  app.get("/api/mcp/servers", async (c) => {
+    try {
+      const [config, cache, provenance] = await Promise.all([
+        loadMcpServerConfig(context.agentDir, context.cwd),
+        loadMcpServerCache(context.agentDir),
+        getServerProvenance(context.agentDir, context.cwd)
+      ]);
+      const servers = Object.entries(config.mcpServers).map(([name, entry]) => {
+        const prov = provenance.get(name);
+        const serverCache = cache?.servers[name] ?? null;
+        return {
+          name,
+          transport: detectTransport(entry),
+          config: redactSensitiveFields(entry),
+          provenance: prov?.kind ?? "user",
+          importSource: prov?.importKind ?? null,
+          cache: serverCache ? {
+            toolCount: serverCache.tools?.length ?? 0,
+            resourceCount: serverCache.resources?.length ?? 0,
+            cachedAt: new Date(serverCache.cachedAt).toISOString(),
+            isValid: isServerCacheValid(serverCache, entry)
+          } : null
+        };
+      });
+      return c.json({
+        servers,
+        settings: {
+          toolPrefix: config.settings?.toolPrefix ?? "server",
+          idleTimeout: config.settings?.idleTimeout ?? 10,
+          directTools: config.settings?.directTools ?? false
+        },
+        imports: config.imports ?? null
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return c.json({ error: message }, 500);
+    }
+  });
+  app.get("/api/mcp/servers/:serverName", async (c) => {
+    const serverName = c.req.param("serverName");
+    try {
+      const [config, cache, provenance] = await Promise.all([
+        loadMcpServerConfig(context.agentDir, context.cwd),
+        loadMcpServerCache(context.agentDir),
+        getServerProvenance(context.agentDir, context.cwd)
+      ]);
+      const entry = config.mcpServers[serverName];
+      if (!entry) {
+        return c.json({ error: `Server "${serverName}" not found` }, 404);
+      }
+      const prov = provenance.get(serverName);
+      const serverCache = cache?.servers[serverName] ?? null;
+      return c.json({
+        name: serverName,
+        transport: detectTransport(entry),
+        config: redactSensitiveFields(entry),
+        provenance: prov?.kind ?? "user",
+        tools: serverCache?.tools?.map((t) => ({
+          name: t.name,
+          description: t.description ?? null,
+          inputSchema: t.inputSchema
+        })) ?? [],
+        resources: serverCache?.resources?.map((r) => ({
+          uri: r.uri,
+          name: r.name,
+          description: r.description ?? null
+        })) ?? [],
+        cache: serverCache ? {
+          configHash: serverCache.configHash,
+          toolCount: serverCache.tools?.length ?? 0,
+          resourceCount: serverCache.resources?.length ?? 0,
+          cachedAt: new Date(serverCache.cachedAt).toISOString(),
+          isValid: isServerCacheValid(serverCache, entry)
+        } : null
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return c.json({ error: message }, 500);
+    }
+  });
+  app.post("/api/mcp/servers", async (c) => {
+    try {
+      const body = await c.req.json();
+      if (!body.name) {
+        return c.json({ error: "Missing required field: name" }, 400);
+      }
+      const nameResult = validateServerName(body.name);
+      if (!nameResult.ok) {
+        return c.json({ error: nameResult.error }, 400);
+      }
+      const entryResult = validateServerEntry(body.config);
+      if (!entryResult.ok) {
+        return c.json({ error: entryResult.error }, 400);
+      }
+      await addMcpServer(context.agentDir, body.name, entryResult.value);
+      return c.json({ ok: true, name: body.name, config: redactSensitiveFields(entryResult.value) });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const status = message.includes("already exists") ? 409 : 500;
+      return c.json({ error: message }, status);
+    }
+  });
+  app.put("/api/mcp/servers/:serverName", async (c) => {
+    const serverName = c.req.param("serverName");
+    try {
+      const provenance = await getServerProvenance(context.agentDir, context.cwd);
+      const prov = provenance.get(serverName);
+      if (prov && prov.kind !== "user") {
+        return c.json({ error: `Cannot modify ${prov.kind} server "${serverName}"` }, 403);
+      }
+      const body = await c.req.json();
+      const entryResult = validateServerEntry(body.config);
+      if (!entryResult.ok) {
+        return c.json({ error: entryResult.error }, 400);
+      }
+      await updateMcpServer(context.agentDir, serverName, entryResult.value);
+      return c.json({ ok: true, name: serverName, config: redactSensitiveFields(entryResult.value) });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const status = message.includes("not found") ? 404 : 500;
+      return c.json({ error: message }, status);
+    }
+  });
+  app.delete("/api/mcp/servers/:serverName", async (c) => {
+    const serverName = c.req.param("serverName");
+    try {
+      const provenance = await getServerProvenance(context.agentDir, context.cwd);
+      const prov = provenance.get(serverName);
+      if (prov && prov.kind !== "user") {
+        return c.json({ error: `Cannot remove ${prov.kind} server "${serverName}"` }, 403);
+      }
+      await removeMcpServer(context.agentDir, serverName);
+      return c.json({ ok: true, name: serverName });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const status = message.includes("not found") ? 404 : 500;
+      return c.json({ error: message }, status);
+    }
+  });
+  app.get("/api/skills", async (c) => {
+    try {
+      const skills = await listSkills(context.agentDir);
+      return c.json({ skills });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return c.json({ error: message }, 500);
+    }
+  });
+  app.get("/api/skills/:skillName", async (c) => {
+    const skillName = c.req.param("skillName");
+    try {
+      const result = await getSkillDetail(context.agentDir, skillName);
+      if (!result) {
+        return c.json({ error: `Skill "${skillName}" not found` }, 404);
+      }
+      return c.json({ ...result.skill, content: result.content });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return c.json({ error: message }, 500);
+    }
+  });
+  app.get("/api/tools", async (c) => {
+    try {
+      const tools = await listAllTools({
+        profile: context.profile,
+        agentDir: context.agentDir,
+        cwd: context.cwd
+      });
+      const builtInCount = tools.filter((t) => t.source === "built-in").length;
+      const mcpCount = tools.filter((t) => t.source !== "built-in").length;
+      return c.json({
+        tools,
+        summary: { builtIn: builtInCount, mcp: mcpCount, total: tools.length }
+      });
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return c.json({ error: message }, 500);
+    }
+  });
   const BOOLEAN_CLI_FLAGS = /* @__PURE__ */ new Set(["json", "verbose", "global", "noAuth", "expand", "i"]);
   function buildCliArgs(pathSegments, query, body) {
     const args = [...pathSegments, "--json"];
@@ -5438,6 +6146,22 @@ async function createAgentServer(params) {
     process.stderr.write(`  POST /api/env/stop                      \u2014 stop dev server
 `);
     process.stderr.write(`  GET  /api/git/diff                      \u2014 uncommitted file diffs
+`);
+    process.stderr.write(`  GET  /api/mcp/servers                   \u2014 list MCP servers
+`);
+    process.stderr.write(`  GET  /api/mcp/servers/:name             \u2014 MCP server details
+`);
+    process.stderr.write(`  POST /api/mcp/servers                   \u2014 add MCP server
+`);
+    process.stderr.write(`  PUT  /api/mcp/servers/:name             \u2014 update MCP server
+`);
+    process.stderr.write(`  DEL  /api/mcp/servers/:name             \u2014 remove MCP server
+`);
+    process.stderr.write(`  GET  /api/skills                        \u2014 list skills
+`);
+    process.stderr.write(`  GET  /api/skills/:name                  \u2014 skill details
+`);
+    process.stderr.write(`  GET  /api/tools                         \u2014 list all tools
 `);
     process.stderr.write(`  *    /api/cli/**                        \u2014 proxy any docyrus CLI command
 
@@ -5487,7 +6211,7 @@ function extractBearerToken(authorizationHeader) {
   return token;
 }
 function hashToken(token) {
-  return (0, import_node_crypto2.createHash)("sha256").update(token).digest();
+  return (0, import_node_crypto3.createHash)("sha256").update(token).digest();
 }
 function isBearerTokenAuthorized(actualToken, expectedToken) {
   if (!expectedToken) {
@@ -5498,7 +6222,7 @@ function isBearerTokenAuthorized(actualToken, expectedToken) {
   }
   const actualHash = hashToken(actualToken);
   const expectedHash = hashToken(expectedToken);
-  return (0, import_node_crypto2.timingSafeEqual)(actualHash, expectedHash);
+  return (0, import_node_crypto3.timingSafeEqual)(actualHash, expectedHash);
 }
 function createUnauthorizedResponse() {
   return new Response(JSON.stringify({ error: "Unauthorized" }), {
@@ -5564,15 +6288,15 @@ function readLoaderRequest() {
 }
 async function loadPiExports() {
   const piPackageDir = readRequiredEnv("PI_PACKAGE_DIR");
-  const moduleUrl = (0, import_node_url.pathToFileURL)((0, import_node_path4.join)(piPackageDir, "dist", "index.js")).href;
+  const moduleUrl = (0, import_node_url.pathToFileURL)((0, import_node_path6.join)(piPackageDir, "dist", "index.js")).href;
   return await import(moduleUrl);
 }
 function resolvePackagedPiResourceRoot() {
   const candidates = [
-    (0, import_node_path4.resolve)(process.cwd(), "apps/api-cli/resources/pi-agent"),
-    (0, import_node_path4.resolve)(__dirname, "../resources/pi-agent"),
-    (0, import_node_path4.resolve)(__dirname, "resources/pi-agent"),
-    (0, import_node_path4.resolve)(process.cwd(), "dist/apps/api-cli/resources/pi-agent")
+    (0, import_node_path6.resolve)(process.cwd(), "apps/api-cli/resources/pi-agent"),
+    (0, import_node_path6.resolve)(__dirname, "../resources/pi-agent"),
+    (0, import_node_path6.resolve)(__dirname, "resources/pi-agent"),
+    (0, import_node_path6.resolve)(process.cwd(), "dist/apps/api-cli/resources/pi-agent")
   ];
   const resolved = candidates.find((candidate) => (0, import_node_fs.existsSync)(candidate));
   if (!resolved) {
@@ -5581,13 +6305,13 @@ function resolvePackagedPiResourceRoot() {
   return resolved;
 }
 function resolvePackagedExtensionPaths(resourceRoot) {
-  const extensionsRoot = (0, import_node_path4.join)(resourceRoot, "extensions");
+  const extensionsRoot = (0, import_node_path6.join)(resourceRoot, "extensions");
   if (!(0, import_node_fs.existsSync)(extensionsRoot)) {
     return [];
   }
   return (0, import_node_fs.readdirSync)(extensionsRoot, {
     withFileTypes: true
-  }).filter((entry) => entry.isDirectory() || entry.isFile() && (entry.name.endsWith(".ts") || entry.name.endsWith(".js"))).map((entry) => (0, import_node_path4.join)(extensionsRoot, entry.name)).sort((left, right) => left.localeCompare(right));
+  }).filter((entry) => entry.isDirectory() || entry.isFile() && (entry.name.endsWith(".ts") || entry.name.endsWith(".js"))).map((entry) => (0, import_node_path6.join)(extensionsRoot, entry.name)).sort((left, right) => left.localeCompare(right));
 }
 function setProcessArgValue(flag, value) {
   const existingIndex = process.argv.indexOf(flag);
@@ -5701,16 +6425,16 @@ async function main() {
   const version = process.env.DOCYRUS_PI_VERSION || "dev";
   const resourceRoot = resolvePackagedPiResourceRoot();
   const packagedExtensionPaths = resolvePackagedExtensionPaths(resourceRoot);
-  const mcpConfigPath = (0, import_node_path4.join)(agentDir, "mcp.json");
+  const mcpConfigPath = (0, import_node_path6.join)(agentDir, "mcp.json");
   const hasPackagedMcpAdapter = packagedExtensionPaths.some((extensionPath) => extensionPath.includes("pi-mcp-adapter"));
-  const envStore = new AgentEnvStore((0, import_node_path4.join)(agentDir, "env.json"));
+  const envStore = new AgentEnvStore((0, import_node_path6.join)(agentDir, "env.json"));
   await envStore.hydrateProcessEnv(process.env);
   if (hasPackagedMcpAdapter) {
     setProcessArgValue("--mcp-config", mcpConfigPath);
   }
-  const authStorage = pi.AuthStorage.create((0, import_node_path4.join)(agentDir, "auth.json"));
+  const authStorage = pi.AuthStorage.create((0, import_node_path6.join)(agentDir, "auth.json"));
   const settingsManager = pi.SettingsManager.create(cwd, agentDir);
-  const modelsJsonPath = (0, import_node_path4.join)(agentDir, "models.json");
+  const modelsJsonPath = (0, import_node_path6.join)(agentDir, "models.json");
   const modelRegistry = new pi.ModelRegistry(authStorage, modelsJsonPath);
   const quietStartup = !request.verbose;
   if (quietStartup) {
@@ -5739,7 +6463,7 @@ async function main() {
     agentDir,
     settingsManager,
     additionalExtensionPaths: packagedExtensionPaths,
-    systemPrompt: (0, import_node_path4.join)(
+    systemPrompt: (0, import_node_path6.join)(
       resourceRoot,
       "prompts",
       request.profile === "agent" ? "agent-system.md" : "coder-system.md"