@echomem/mcp 1.4.50 → 1.4.52

package/dist/index.js

@@ -4,7 +4,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { CallToolRequestSchema, ErrorCode, ListToolsRequestSchema, McpError, } from "@modelcontextprotocol/sdk/types.js";
 import axios from "axios";
 import { ZodError } from "zod";
-import { bindSourceSessionSchema, canonicalToolNames, completeGroupPublicationSchema, createGroupInviteSchema, createGroupSchema, deleteMemorySchema, flagPublicationAttentionSchema, getGroupSessionSharingSchema, getByContextSchema, groupContextSchema, joinGroupSchema, keywordsSchema, listFriendsSchema, listToolSpecs, othersSchema, publishBatchToGroupSchema, publishToGroupSchema, prepareGroupPublicationSchema, publicMemorySchema, recordMemoryCitationsSchema, requestGroupSessionSharingSchema, resolveCanonicalToolName, saveConversationSchema, searchMemoriesSchema, searchUsersSchema, sendFriendRequestSchema, timeRangeSchema, updateGroupProfileSchema, setGroupSessionSharingSchema, } from "./v1-contract.js";
+import { bindSourceSessionSchema, canonicalToolNames, completeGroupPublicationSchema, createGroupInviteSchema, createGroupSchema, deleteMemorySchema, flagPublicationAttentionSchema, getGroupSessionSharingSchema, getByContextSchema, groupContextSchema, joinGroupSchema, keywordsSchema, listFriendsSchema, listToolSpecs, linkWorkspaceTicketSessionSchema, othersSchema, publishBatchToGroupSchema, publishToGroupSchema, prepareGroupPublicationSchema, publicMemorySchema, recordMemoryCitationsSchema, requestGroupSessionSharingSchema, resolveCanonicalToolName, saveConversationSchema, searchMemoriesSchema, searchUsersSchema, sendFriendRequestSchema, timeRangeSchema, updateGroupProfileSchema, setGroupSessionSharingSchema, } from "./v1-contract.js";
 import { KeyStore } from "./keystore.js";
 import { EventLogger, hashText } from "./events.js";
 import { contextHealthMarkdown, recomposeCapsuleMarkdown } from "./hud/api.js";
@@ -16,7 +16,7 @@ import { MCP_PACKAGE_VERSION, MCP_SERVER_INSTRUCTIONS, MEMORY_CITATION_INSTRUCTI
 import { clearBillingAlert, writeBillingAlert } from "./billing-alert.js";
 import { checkLatestUpdateStatus, formatUpdateNotice, formatUpdateStatusText, startBackgroundUpdateCheck, } from "./update-check.js";
 import { autoUpdateHeadlessRuntime } from "./headless-runtime.js";
-import { resolveSourceSessionFromMcpContext, resolveSourceSessionFromBindingToken, } from "./source-session.js";
+import { resolveSourceSessionRequestContext, resolveSourceSessionFromBindingToken, } from "./source-session.js";
 const ECHO_API_BASE_URL = process.env.ECHO_API_BASE_URL || "https://echo-mem-chrome.vercel.app";
 const ECHO_PRICING_URL = process.env.ECHO_PRICING_URL || "https://echoknows.com/account";
 const ECHO_MEMORY_WEB_URL = (process.env.ECHO_MEMORY_WEB_URL || "https://echoknows.com/memory").replace(/\/$/, "");
@@ -169,6 +169,17 @@ function formatReconnectRequiredResult(error) {
         "No editor restart is needed. Keep all credentials out of chat.",
     ].join("\n");
 }
+function formatWorkspaceTicketNotFoundResult(error) {
+    if (!axios.isAxiosError(error) || error.response?.status !== 404)
+        return null;
+    if (errorCodeFrom(error.response.data) !== "WORKSPACE_TICKET_NOT_FOUND")
+        return null;
+    return [
+        "🎫 This Echo workspace ticket no longer exists or is unavailable.",
+        "Do not retry this ticket ID.",
+        "Ask the user whether to continue without a ticket or attach this session to another ticket.",
+    ].join("\n");
+}
 /** Map a thrown error to the telemetry error_kind taxonomy. */
 function classifyError(error) {
     if (error instanceof NoTokenError)
@@ -339,6 +350,9 @@ function detectMcpHostFromEnv() {
         return "cursor";
     if (process.env.WINDSURF_WORKSPACE_ID || process.env.WINDSURF_USER_ID)
         return "windsurf";
+    // Cowork embeds a Claude Code process, but this outer host ID is the distinguishing signal.
+    if (process.env.CLAUDE_CODE_HOST_SESSION_ID)
+        return "cowork";
     if (process.env.CLAUDE_CODE || process.env.CLAUDECODE || process.env.ANTHROPIC_CLAUDE_CODE) {
         return "claude_code";
     }
@@ -582,6 +596,14 @@ function inputAnalyticsForTool(canonicalName, args) {
                 receipt_id_hash: receiptId ? hashText(receiptId) : undefined,
             };
         }
+        case canonicalToolNames.linkWorkspaceTicketSession: {
+            const ticketId = readString(a, "ticketId");
+            const workspaceId = readString(a, "workspaceId");
+            return {
+                ticket_id_hash: ticketId ? hashText(ticketId) : undefined,
+                workspace_id_hash: workspaceId ? hashText(workspaceId) : undefined,
+            };
+        }
         case canonicalToolNames.flagPublicationAttention: {
             const memoryIds = Array.isArray(a.memoryIds) ? a.memoryIds.filter((id) => typeof id === "string") : [];
             return {
@@ -609,13 +631,22 @@ function inputAnalyticsForTool(canonicalName, args) {
 function toolEventName(canonicalName, status) {
     return `[MCP] ${canonicalName} ${status}`;
 }
+const SUBAGENT_DURABLE_WRITE_MESSAGE = [
+    "Codex subagents cannot save EchoMem memories or manage conversation sharing.",
+    "Return durable findings to the root agent; the root agent must consolidate them and call save_conversation once.",
+].join(" ");
+const SUBAGENT_ROOT_ONLY_TOOLS = new Set([
+    canonicalToolNames.save,
+    canonicalToolNames.requestGroupSessionSharing,
+    canonicalToolNames.setGroupSessionSharing,
+]);
 class EchoMemApiClient {
     store;
     axios;
     activeToken;
     accountGeneration = 0;
     boundSourceSession = null;
-    requestSourceSession = new AsyncLocalStorage();
+    requestContext = new AsyncLocalStorage();
     sourceSessionsByCanonicalKey = new Map();
     whoamiCache = null;
     /** One id per bridge process — groups all saves from this coding session under a single EchoMem context. */
@@ -677,10 +708,20 @@ class EchoMemApiClient {
     }
     getBoundSourceSession() {
         this.synchronizeAccountContext();
-        return this.requestSourceSession.getStore() ?? this.boundSourceSession;
+        const requestContext = this.requestContext.getStore();
+        return requestContext === undefined ? this.boundSourceSession : requestContext.sourceSession;
     }
-    async withSourceSession(sourceSession, operation) {
-        return sourceSession ? this.requestSourceSession.run(sourceSession, operation) : operation();
+    getRequestVerifiedSourceSession() {
+        const requestContext = this.requestContext.getStore();
+        if (!requestContext || requestContext.lineageStatus === "unbound")
+            return null;
+        return requestContext.sourceSession;
+    }
+    isSubagentRequest() {
+        return this.requestContext.getStore()?.isSubagent === true;
+    }
+    async withRequestContext(requestContext, operation) {
+        return this.requestContext.run(requestContext, operation);
     }
     async bindSourceSession(verified, persistForBridge = true) {
         this.synchronizeAccountContext();
@@ -714,6 +755,21 @@ class EchoMemApiClient {
             created: response.data?.created === true,
         };
     }
+    async linkWorkspaceTicketSession(args) {
+        const parsed = linkWorkspaceTicketSessionSchema.parse(args ?? {});
+        // A bridge-level compatibility binding can outlive a conversation in
+        // long-running hosts. Ticket links are therefore allowed to take the fast
+        // path only from identity verified for this exact request; otherwise the
+        // Desktop transcript watcher completes the link from local evidence.
+        const sourceSession = this.getRequestVerifiedSourceSession();
+        if (!sourceSession)
+            return null;
+        const response = await this.axios.post(`/api/extension/workspace-tickets/${encodeURIComponent(parsed.ticketId)}/sessions`, {
+            contextId: sourceSession.contextId,
+            workspaceId: parsed.workspaceId,
+        });
+        return response.data;
+    }
     async trackMcpAnalyticsEvent(eventType, eventProperties, insertId) {
         if (!this.hasToken())
             return;
@@ -966,6 +1022,9 @@ class EchoMemApiClient {
         return data;
     }
     async saveConversation(args) {
+        if (this.isSubagentRequest()) {
+            throw new Error(SUBAGENT_DURABLE_WRITE_MESSAGE);
+        }
         const parsed = saveConversationSchema.parse(args ?? {});
         const groupSharingScopeId = parsed.groupSharingScopeId ?? randomUUID();
         let rawData = parsed.conversation?.trim() || "";
@@ -984,6 +1043,7 @@ class EchoMemApiClient {
         const config = {
             headers: {
                 "X-EchoMem-Request-Id": randomUUID(),
+                "X-EchoMem-Origin-Channel": "local_mcp",
                 ...(enc.enabled && enc.key ? { "X-Encryption-Key": enc.key } : {}),
             },
         };
@@ -1365,8 +1425,10 @@ class EchoMemMCPServer {
         });
     }
     getMcpClientAnalytics() {
-        const hostPlatform = normalizeMcpHostPlatform(this.mcpClientName)
-            ?? detectMcpHostFromEnv()
+        const environmentPlatform = detectMcpHostFromEnv();
+        const hostPlatform = (environmentPlatform === "cowork" ? environmentPlatform : undefined)
+            ?? normalizeMcpHostPlatform(this.mcpClientName)
+            ?? environmentPlatform
             ?? "unknown";
         return {
             mcp_client_name: this.mcpClientName,
@@ -1429,21 +1491,32 @@ class EchoMemMCPServer {
             const clientVersion = this.server.getClientVersion();
             this.mcpClientName = clientVersion?.name ?? this.mcpClientName;
             this.mcpClientVersion = clientVersion?.version ?? this.mcpClientVersion;
-            let requestSourceSession = this.client.getBoundSourceSession();
-            let inferred = null;
+            let sourceResolution = {
+                sourceSession: null,
+                isSubagent: false,
+                lineageStatus: "unbound",
+            };
             try {
-                inferred = resolveSourceSessionFromMcpContext(extra._meta, { hostPlatform: this.getMcpClientAnalytics().host_platform });
+                sourceResolution = resolveSourceSessionRequestContext(extra._meta, { hostPlatform: this.getMcpClientAnalytics().host_platform });
             }
             catch {
                 // Malformed host metadata is not model input. Ignore it and retain the explicit fallback.
             }
+            // A child request starts fail-closed. Resolved children bind to the originating root; unresolved
+            // children carry an explicit null so AsyncLocalStorage cannot fall through to a global binding.
+            let requestSourceSession = sourceResolution.isSubagent
+                ? null
+                : this.client.getBoundSourceSession();
             // Verified request metadata always wins over a bridge-level compatibility fallback. The
             // startup hook performs the eager write; this path attaches the exact context to the current
             // request and retries the backend write if startup raced login.
-            if (inferred && this.client.hasToken()) {
-                requestSourceSession = await this.client.bindSourceSession(inferred, false);
+            if (sourceResolution.sourceSession && this.client.hasToken()) {
+                requestSourceSession = await this.client.bindSourceSession(sourceResolution.sourceSession, false);
             }
-            return this.client.withSourceSession(requestSourceSession, async () => {
+            return this.client.withRequestContext({
+                ...sourceResolution,
+                sourceSession: requestSourceSession,
+            }, async () => {
                 const t0 = Date.now();
                 const analyticsBase = {
                     surface: "mcp",
@@ -1454,6 +1527,18 @@ class EchoMemMCPServer {
                     codex_session_id: this.client.getBoundSourceSession()?.canonicalKey ?? this.client.getSessionId(),
                     conversation_id: this.client.getBoundSourceSession()?.canonicalKey ?? this.client.getSessionId(),
                     context_id: this.client.getBoundSourceSession()?.contextId,
+                    agent_is_subagent: sourceResolution.isSubagent,
+                    agent_lineage_status: sourceResolution.lineageStatus,
+                    agent_depth: sourceResolution.agentDepth,
+                    agent_thread_id_hash: sourceResolution.agentThreadId
+                        ? hashText(sourceResolution.agentThreadId)
+                        : undefined,
+                    agent_parent_thread_id_hash: sourceResolution.parentThreadId
+                        ? hashText(sourceResolution.parentThreadId)
+                        : undefined,
+                    agent_root_thread_id_hash: sourceResolution.rootThreadId
+                        ? hashText(sourceResolution.rootThreadId)
+                        : undefined,
                     tool_name: request.params.name,
                     canonical_tool_name: canonicalName,
                     ...triggerAnalyticsForTool(canonicalName, toolArgs),
@@ -1471,6 +1556,13 @@ class EchoMemMCPServer {
                     if (recallRoute.error) {
                         throw new McpError(ErrorCode.InvalidParams, recallRoute.error);
                     }
+                    if (sourceResolution.isSubagent && SUBAGENT_ROOT_ONLY_TOOLS.has(canonicalName)) {
+                        rec.error_kind = "invalid_args";
+                        return {
+                            content: [{ type: "text", text: SUBAGENT_DURABLE_WRITE_MESSAGE }],
+                            isError: true,
+                        };
+                    }
                     if (canonicalName === canonicalToolNames.updateStatus) {
                         if (DESKTOP_MANAGED) {
                             return {
@@ -1502,6 +1594,14 @@ class EchoMemMCPServer {
                             ? client
                             : "auto";
                         const capsuleText = await recomposeCapsuleMarkdown(mode);
+                        if (this.client.isSubagentRequest()) {
+                            return {
+                                content: [{
+                                        type: "text",
+                                        text: `${capsuleText}\n\n---\nNot persisted: ${SUBAGENT_DURABLE_WRITE_MESSAGE}`,
+                                    }],
+                            };
+                        }
                         // If logged in, persist the capsule via passthrough so it's retrievable by contextId.
                         if (this.client.hasToken()) {
                             try {
@@ -1536,6 +1636,8 @@ class EchoMemMCPServer {
                     switch (canonicalName) {
                         case canonicalToolNames.bindSourceSession:
                             return await this.handleBindSourceSession(request.params.arguments);
+                        case canonicalToolNames.linkWorkspaceTicketSession:
+                            return await this.handleLinkWorkspaceTicketSession(request.params.arguments);
                         case canonicalToolNames.search:
                             return await this.handleSearch(toolArgs, rec);
                         case canonicalToolNames.save:
@@ -1649,6 +1751,13 @@ class EchoMemMCPServer {
                             isError: true,
                         };
                     }
+                    const missingWorkspaceTicket = formatWorkspaceTicketNotFoundResult(error);
+                    if (missingWorkspaceTicket) {
+                        return {
+                            content: [{ type: "text", text: missingWorkspaceTicket }],
+                            isError: true,
+                        };
+                    }
                     const upgradeRequired = formatUpgradeRequiredResult(error);
                     if (upgradeRequired) {
                         return {
@@ -1925,6 +2034,40 @@ Details: ${m.details || "N/A"}`)
                 }],
         };
     }
+    async handleLinkWorkspaceTicketSession(args) {
+        const parsed = linkWorkspaceTicketSessionSchema.parse(args ?? {});
+        const result = await this.client.linkWorkspaceTicketSession(parsed);
+        if (!result) {
+            return {
+                content: [{
+                        type: "text",
+                        text: [
+                            `Ticket ${parsed.ticketId} link is pending verified source-session discovery.`,
+                            "Echo Desktop can finish this link from the structured ticket marker or this exact local tool invocation.",
+                            "Do not guess a context ID or call bind_source_session on the user's behalf unless its documented compatibility fallback is actually needed.",
+                        ].join("\n"),
+                    }],
+            };
+        }
+        const ticket = isRecord(result.ticket) ? result.ticket : {};
+        const workspaceId = readString(ticket, "workspaceId") ?? parsed.workspaceId;
+        const sourceSession = this.client.getBoundSourceSession();
+        return {
+            content: [{
+                    type: "text",
+                    text: [
+                        result.changed === true
+                            ? "Linked this verified source session to the Echo workspace ticket."
+                            : "This verified source session was already linked to the Echo workspace ticket.",
+                        `Ticket: ${parsed.ticketId}`,
+                        workspaceId ? `Workspace: ${workspaceId}` : "",
+                        sourceSession ? `Source session: ${sourceSession.canonicalKey}` : "",
+                        sourceSession ? `Context: ${sourceSession.contextId}` : "",
+                        "Retries are safe and do not create duplicate links or history events.",
+                    ].filter(Boolean).join("\n"),
+                }],
+        };
+    }
     async handleTimeRange(args) {
         const parsed = timeRangeSchema.parse(args ?? {});
         const { success, memories, error } = await this.client.getMemoriesByTimeRange(args);

package/dist/mcp-control.js

@@ -0,0 +1,215 @@
+import http from "node:http";
+import { randomUUID } from "node:crypto";
+function connectEchoPage(nonce) {
+    const safeNonce = JSON.stringify(nonce);
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Connect Echo</title>
+  <style>
+    :root { color-scheme:light; --ink:#172019; --muted:#667168; --line:#dce4da; --leaf:#315d38; --leaf-soft:#edf5eb; --paper:#f6f7f2; --warn:#9b392b; --warn-soft:#faebe7; --amber:#8a611b; --amber-soft:#fff4d8; }
+    * { box-sizing:border-box; }
+    body { margin:0; background:radial-gradient(circle at 14% 0%,#eef4e8 0,transparent 33%),var(--paper); color:var(--ink); font:15px/1.5 ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif; }
+    main { width:min(980px,calc(100% - 32px)); margin:38px auto 80px; }
+    h1,h2,h3,p { margin:0; } h1 { font-size:clamp(34px,5vw,58px); letter-spacing:-.05em; line-height:.98; }
+    button { border:0; border-radius:11px; padding:10px 14px; font:inherit; font-weight:800; cursor:pointer; }
+    button:disabled { cursor:wait; opacity:.52; }
+    .primary { color:white; background:var(--leaf); } .secondary { color:var(--ink); background:#eef1eb; } .danger { color:white; background:var(--warn); }
+    .top { display:flex; justify-content:space-between; align-items:end; gap:22px; margin-bottom:20px; }
+    .eyebrow { color:var(--leaf); font-size:12px; font-weight:850; letter-spacing:.14em; text-transform:uppercase; margin-bottom:8px; }
+    .local { border:1px solid var(--line); border-radius:999px; padding:7px 11px; color:var(--muted); background:rgba(255,255,255,.85); white-space:nowrap; }
+    .panel { background:rgba(255,255,255,.94); border:1px solid var(--line); border-radius:20px; padding:20px; box-shadow:0 16px 50px rgba(34,54,35,.065); margin-top:14px; }
+    .account { display:grid; grid-template-columns:1fr auto; align-items:center; gap:18px; }
+    .accountTitle { display:flex; align-items:center; gap:9px; margin-bottom:5px; }
+    .accountTitle strong { font-size:20px; } .sub,.note,.host p { color:var(--muted); }
+    .facts { display:flex; flex-wrap:wrap; justify-content:flex-end; gap:8px; }
+    .pill,.badge { border-radius:999px; padding:5px 9px; background:var(--leaf-soft); color:#2d6337; font-size:12px; font-weight:850; }
+    .pill.bad,.badge.bad { color:var(--warn); background:var(--warn-soft); } .pill.warn,.badge.warn { color:var(--amber); background:var(--amber-soft); }
+    .environment { display:none; margin-top:12px; border-radius:12px; background:var(--amber-soft); color:#6d4c15; padding:10px 12px; }
+    .sectionHead { display:flex; justify-content:space-between; align-items:center; gap:16px; margin-bottom:14px; }
+    .sectionHead h2 { font-size:22px; letter-spacing:-.02em; }
+    .hosts { display:grid; grid-template-columns:repeat(auto-fit,minmax(255px,1fr)); gap:12px; }
+    .host { border:1px solid var(--line); border-radius:16px; padding:16px; min-height:190px; display:flex; flex-direction:column; }
+    .hostHead { display:flex; justify-content:space-between; align-items:center; gap:10px; }
+    .host h3 { font-size:17px; } .host p { margin-top:8px; font-size:13px; overflow-wrap:anywhere; }
+    .host code { display:block; margin-top:7px; color:#788179; font:11px/1.4 ui-monospace,SFMono-Regular,Consolas,monospace; overflow-wrap:anywhere; }
+    .hostActions { display:flex; flex-wrap:wrap; gap:8px; margin-top:auto; padding-top:15px; }
+    .empty { padding:24px; border:1px dashed #cbd5c9; border-radius:14px; color:var(--muted); }
+    .recovery { display:grid; grid-template-columns:1fr auto; align-items:center; gap:18px; }
+    .recovery h2 { font-size:20px; } .recovery p { color:var(--muted); margin-top:5px; max-width:650px; }
+    .advanced { margin-top:14px; border-top:1px solid var(--line); padding-top:13px; }
+    .advanced summary { cursor:pointer; color:var(--muted); font-weight:750; }
+    .advancedBody { display:flex; justify-content:space-between; align-items:center; gap:18px; margin-top:12px; }
+    .advancedBody p { color:var(--muted); max-width:680px; }
+    #message { min-height:25px; margin:14px 2px 0; color:var(--muted); }
+    @media(max-width:700px) { .top { align-items:start; flex-direction:column; } .account,.recovery { grid-template-columns:1fr; } .facts { justify-content:flex-start; } .advancedBody { align-items:start; flex-direction:column; } }
+  </style>
+</head>
+<body>
+<main>
+  <header class="top"><div><p class="eyebrow">Windows MCP control center</p><h1>Connect Echo</h1></div><span class="local">Localhost only</span></header>
+  <section class="panel account" aria-live="polite">
+    <div><div class="accountTitle"><strong id="accountHeadline">Checking this profile…</strong><span class="pill warn" id="accountBadge">Checking</span></div><p class="sub" id="accountDetail">Validating the account, vault, and managed runtime.</p><p class="environment" id="environment"></p></div>
+    <div class="facts"><span class="pill" id="runtimeFact">Runtime —</span><span class="pill" id="vaultFact">Vault —</span><span class="pill" id="activityFact">No tool activity yet</span></div>
+  </section>
+  <section class="panel">
+    <div class="sectionHead"><div><h2>Your AI tools</h2><p class="note">Connect, inspect, or repair each detected Windows host independently.</p></div><button class="secondary" id="refresh">Run Doctor</button></div>
+    <div class="hosts" id="hosts"><p class="empty">Detecting supported MCP hosts…</p></div>
+  </section>
+  <section class="panel recovery">
+    <div><h2>Clean reconnect</h2><p>Install a validated latest runtime, clear inactive EchoMem-managed versions, and repair every detected host. Credentials and cloud memories stay intact.</p></div>
+    <button class="primary" id="reconnect">Reconnect all</button>
+  </section>
+  <details class="panel advanced">
+    <summary>Advanced controls</summary>
+    <div class="advancedBody"><p>Uninstall removes EchoMem host registrations, lifecycle hooks, guidance, Codex skills, and the managed runtime. It preserves the account credential, vault key, and cloud memories.</p><button class="danger" id="uninstall">Uninstall MCP…</button></div>
+  </details>
+  <p id="message" role="status"></p>
+</main>
+<script>
+(() => {
+  const nonce = ${safeNonce};
+  const message = document.getElementById("message");
+  const buttons = () => Array.from(document.querySelectorAll("button"));
+  const esc = (value) => String(value == null ? "" : value).replace(/[&<>"']/g, (ch) => ({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"}[ch]));
+  const busy = (state) => buttons().forEach((button) => { button.disabled = state; });
+  async function request(path, method, payload) {
+    const response = await fetch(path + "?nonce=" + encodeURIComponent(nonce), {
+      method: method || "GET", credentials:"omit", cache:"no-store",
+      headers:{"Content-Type":"application/json"}, body:method === "POST" ? JSON.stringify(Object.assign({nonce},payload || {})) : undefined
+    });
+    const raw = await response.text(); let data = {};
+    try { data = raw ? JSON.parse(raw) : {}; } catch (_) {}
+    if (!response.ok) throw new Error(data.message || raw || ("HTTP " + response.status));
+    return data;
+  }
+  function tone(state) {
+    return state === "connected" || state === "unlocked" || state === "unencrypted" || state === "ready" ? "" : state === "unreachable" || state === "unknown" || state === "attention" || state === "not_checked" ? "warn" : "bad";
+  }
+  function label(value) { return String(value || "unknown").replace(/_/g," "); }
+  function render(report) {
+    const account = report.account || {state:report.credentialsPresent ? "not_checked" : "not_connected",detail:""};
+    const vault = report.vault || {state:report.vaultKeyPresent ? "not_checked" : "unknown",detail:""};
+    const accountBadge = document.getElementById("accountBadge");
+    document.getElementById("accountHeadline").textContent = account.state === "connected" ? "Echo account connected" : account.state === "not_connected" ? "Echo account not connected" : account.state === "invalid" ? "Echo account needs reconnecting" : "Echo account check needs attention";
+    accountBadge.textContent = label(account.state);
+    accountBadge.className = "pill " + tone(account.state);
+    document.getElementById("accountDetail").textContent = account.detail || "";
+    const runtime = report.runtime && report.runtime.version ? report.runtime.version : "not installed";
+    const runtimeFact = document.getElementById("runtimeFact"); runtimeFact.textContent = "Runtime " + runtime; runtimeFact.className = "pill " + (report.runtime ? "" : "bad");
+    const vaultFact = document.getElementById("vaultFact"); vaultFact.textContent = "Vault " + label(vault.state); vaultFact.className = "pill " + tone(vault.state);
+    const activity = document.getElementById("activityFact");
+    activity.textContent = report.lastSearch ? (report.lastSearch.ok ? "Last search succeeded" : "Last search failed") : "No recent search";
+    activity.className = "pill " + (report.lastSearch && report.lastSearch.ok === false ? "bad" : report.lastSearch ? "" : "warn");
+    const environment = document.getElementById("environment");
+    environment.textContent = report.environment && report.environment.detail || "";
+    environment.style.display = report.environment && (report.environment.wsl || !report.environment.windowsNative) ? "block" : "none";
+
+    const clients = Array.isArray(report.clients) ? report.clients : [];
+    document.getElementById("hosts").innerHTML = clients.length ? clients.map((client) => {
+      const action = client.recommendedAction || (!client.configured ? "connect" : client.state === "ok" ? "none" : "repair");
+      const primary = action === "connect" ? '<button class="primary" data-host-action="connect" data-client-id="' + esc(client.id) + '">Connect</button>' : action === "repair" ? '<button class="primary" data-host-action="repair" data-client-id="' + esc(client.id) + '">Repair</button>' : '';
+      const disconnect = client.configured ? '<button class="secondary" data-host-action="disconnect" data-client-id="' + esc(client.id) + '">Disconnect</button>' : '';
+      const version = client.version || (client.runtime === "latest" ? "latest at launch" : "version unknown");
+      return '<article class="host"><div class="hostHead"><h3>' + esc(client.label) + '</h3><span class="badge ' + tone(client.health) + '">' + esc(label(client.health)) + '</span></div><p>' + esc(client.configured ? "EchoMem MCP is configured for this host." : "Detected on this profile, but EchoMem is not configured.") + '</p><p>' + esc(version) + '</p><code>' + esc(client.detail || "") + '</code><div class="hostActions">' + primary + disconnect + '</div></article>';
+    }).join("") : '<p class="empty">No supported MCP host was detected in this profile. Native Windows and WSL have separate installations.</p>';
+  }
+  async function doctor(statusText) { busy(true); message.textContent = statusText || "Running MCP Doctor…"; try { const data = await request("/doctor"); render(data); message.textContent = "Doctor finished. No configuration was changed."; return data; } catch (error) { message.textContent = error.message; } finally { busy(false); } }
+  document.getElementById("refresh").onclick = () => void doctor();
+  document.getElementById("hosts").onclick = async (event) => {
+    const button = event.target && event.target.closest ? event.target.closest("[data-host-action]") : null;
+    if (!button) return;
+    const clientId = button.getAttribute("data-client-id"); const action = button.getAttribute("data-host-action");
+    if (action === "disconnect" && !confirm("Disconnect EchoMem from this host? Your account and memories will be preserved.")) return;
+    busy(true); message.textContent = action === "disconnect" ? "Disconnecting this host…" : action === "repair" ? "Repairing this host…" : "Connecting this host…";
+    try { await request(action === "disconnect" ? "/disconnect-host" : "/connect-host","POST",{clientId,repair:action === "repair"}); await doctor(); message.textContent = action === "disconnect" ? "Host disconnected. Restart it to unload EchoMem." : "Host configured. Start a new session in it to load EchoMem."; } catch (error) { message.textContent = error.message; } finally { busy(false); }
+  };
+  document.getElementById("reconnect").onclick = async () => { if (!confirm("Reconnect every detected host with a clean managed runtime? Active sessions keep their current runtime until restarted.")) return; busy(true); message.textContent = "Installing a clean runtime and repairing detected hosts…"; try { await request("/reconnect","POST"); await doctor(); message.textContent = "Clean reconnect complete. Restart each host to load the new runtime."; } catch (error) { message.textContent = error.message; } finally { busy(false); } };
+  document.getElementById("uninstall").onclick = async () => { if (!confirm("Uninstall EchoMem MCP from this profile? Login, vault credentials, and cloud memories will be preserved.")) return; busy(true); message.textContent = "Removing EchoMem MCP components…"; try { await request("/uninstall","POST"); await doctor(); message.textContent = "EchoMem MCP removed. Credentials and cloud memories were preserved."; } catch (error) { message.textContent = error.message; } finally { busy(false); } };
+  void doctor("Checking this Windows profile…");
+})();
+</script>
+</body></html>`;
+}
+function readJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > 4096) {
+                reject(new Error("Request too large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => {
+            try {
+                const raw = Buffer.concat(chunks).toString("utf8");
+                const parsed = raw ? JSON.parse(raw) : {};
+                if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                    throw new Error("Invalid JSON body");
+                resolve(parsed);
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+        req.on("error", reject);
+    });
+}
+export async function startMcpControlServer(actions) {
+    const nonce = randomUUID();
+    let operation = null;
+    const server = http.createServer((req, res) => {
+        const url = new URL(req.url || "/", "http://127.0.0.1");
+        const json = (status, body) => res.writeHead(status, { "Content-Type": "application/json", "Cache-Control": "no-store" }).end(JSON.stringify(body));
+        const run = async () => {
+            if (url.searchParams.get("nonce") !== nonce)
+                return void json(403, { message: "Invalid local control nonce." });
+            if (url.pathname === "/" && req.method === "GET")
+                return void res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" }).end(connectEchoPage(nonce));
+            if (url.pathname === "/doctor" && req.method === "GET")
+                return void json(200, await actions.doctor());
+            if (req.method !== "POST")
+                return void json(404, { message: "Not found." });
+            const body = await readJsonBody(req);
+            if (operation)
+                return void json(409, { message: "Another Connect Echo operation is still running." });
+            const clientId = typeof body.clientId === "string" ? body.clientId : "";
+            const action = url.pathname === "/connect-host"
+                ? () => actions.connectHost(clientId, body.repair === true)
+                : url.pathname === "/disconnect-host"
+                    ? () => actions.disconnectHost(clientId)
+                    : url.pathname === "/reconnect"
+                        ? actions.reconnect
+                        : url.pathname === "/uninstall"
+                            ? actions.uninstall
+                            : null;
+            if (!action)
+                return void json(404, { message: "Not found." });
+            operation = Promise.resolve().then(action);
+            try {
+                return void json(200, await operation);
+            }
+            finally {
+                operation = null;
+            }
+        };
+        run().catch((error) => {
+            if (!res.writableEnded)
+                json(500, { message: error instanceof Error ? error.message : String(error) });
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve());
+    });
+    const address = server.address();
+    if (!address || typeof address === "string")
+        throw new Error("Could not bind the local Connect Echo page.");
+    return { url: `http://127.0.0.1:${address.port}/?nonce=${encodeURIComponent(nonce)}`, close: () => server.close() };
+}