@flyingrobots/graft 0.4.0 → 0.6.0

package/dist/mcp/context.js

@@ -0,0 +1,79 @@
+// ---------------------------------------------------------------------------
+// ToolContext — shared dependencies injected into every tool handler
+// ---------------------------------------------------------------------------
+import * as fs from "node:fs";
+import * as path from "node:path";
+/**
+ * Resolve a user-provided path against projectRoot with traversal guard.
+ * Both absolute and relative paths are confined to the project root.
+ * Symlinks are resolved before the confinement check to prevent escapes.
+ */
+export function createPathResolver(projectRoot) {
+    const normalizedRoot = path.resolve(projectRoot);
+    // Resolve the project root itself through symlinks for consistent comparison
+    let realProjectRoot;
+    try {
+        realProjectRoot = fs.realpathSync(normalizedRoot);
+    }
+    catch {
+        realProjectRoot = normalizedRoot;
+    }
+    return (input) => {
+        // Resolve: absolute paths are taken as-is, relative paths join to projectRoot
+        const resolved = path.isAbsolute(input)
+            ? path.resolve(input)
+            : path.resolve(normalizedRoot, input);
+        // Logical confinement check (catches ".." traversal without needing fs access)
+        const logicalRel = path.relative(normalizedRoot, resolved);
+        if (logicalRel.startsWith("..") || path.isAbsolute(logicalRel)) {
+            throw new Error(`Path traversal blocked: ${input}`);
+        }
+        // Resolve symlinks before a second confinement check to prevent symlink escapes
+        let real;
+        try {
+            real = fs.realpathSync(resolved);
+        }
+        catch {
+            // Target doesn't exist yet — return the logical path (already passed confinement)
+            return resolved;
+        }
+        // Symlink confinement check: the real path must be within the real project root
+        const realRel = path.relative(realProjectRoot, real);
+        if (realRel.startsWith("..") || path.isAbsolute(realRel)) {
+            throw new Error(`Path traversal blocked: ${input}`);
+        }
+        return resolved;
+    };
+}
+/**
+ * Runtime guard: asserts that the supplied value satisfies the ToolContext
+ * shape.  Used at composition-root boundaries to catch wiring errors early.
+ */
+export function assertToolContext(value) {
+    if (value === null || typeof value !== "object") {
+        throw new Error("ToolContext must be an object");
+    }
+    const obj = value;
+    const ports = ["fs", "codec", "process", "git"];
+    for (const port of ports) {
+        if (obj[port] === undefined || obj[port] === null) {
+            throw new Error(`ToolContext missing port: ${port}`);
+        }
+    }
+    const governanceProps = ["governor", "cache", "metrics"];
+    for (const prop of governanceProps) {
+        if (obj[prop] === undefined || obj[prop] === null) {
+            throw new Error(`ToolContext missing governance property: ${prop}`);
+        }
+    }
+    const methods = ["respond", "resolvePath", "getWarp", "getRepoState", "getCausalContext", "getWorkspaceStatus"];
+    for (const method of methods) {
+        if (obj[method] === undefined || obj[method] === null) {
+            throw new Error(`ToolContext missing method: ${method}`);
+        }
+        if (typeof obj[method] !== "function") {
+            throw new Error(`ToolContext missing method: ${method} (got ${typeof obj[method]})`);
+        }
+    }
+}
+//# sourceMappingURL=context.js.map

package/dist/mcp/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/mcp/context.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAsGlC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEjD,6EAA6E;IAC7E,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe,GAAG,cAAc,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,KAAa,EAAU,EAAE;QAC/B,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAExC,+EAA+E;QAC/E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,gFAAgF;QAChF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;YAClF,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,gFAAgF;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAE7C,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;IACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,CAAU,CAAC;IACzH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,SAAS,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/mcp/control-plane/authz-storage.d.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import type { JsonCodec } from "../../ports/codec.js";
+import type { FileSystem } from "../../ports/filesystem.js";
+import type { WorkspaceCapabilityProfile } from "../workspace-router.js";
+import type { AuthorizedWorkspaceRecord } from "./types.js";
+declare const persistedControlPlaneStateSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    workspaces: z.ZodArray<z.ZodObject<{
+        repoId: z.ZodString;
+        worktreeId: z.ZodString;
+        worktreeRoot: z.ZodString;
+        gitCommonDir: z.ZodString;
+        capabilityProfile: z.ZodObject<{
+            boundedReads: z.ZodBoolean;
+            structuralTools: z.ZodBoolean;
+            precisionTools: z.ZodBoolean;
+            stateBookmarks: z.ZodBoolean;
+            runtimeLogs: z.ZodLiteral<"session_local_only">;
+            runCapture: z.ZodBoolean;
+        }, z.core.$strict>;
+        authorizedAt: z.ZodString;
+        lastBoundAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type PersistedControlPlaneState = z.infer<typeof persistedControlPlaneStateSchema>;
+export declare function cloneCapabilityProfile(profile: WorkspaceCapabilityProfile): WorkspaceCapabilityProfile;
+export declare function capabilityProfilesEqual(left: WorkspaceCapabilityProfile, right: WorkspaceCapabilityProfile): boolean;
+export declare function resolveCapabilityProfile(current: WorkspaceCapabilityProfile | undefined, defaultProfile: WorkspaceCapabilityProfile, runCapture: boolean | undefined): WorkspaceCapabilityProfile;
+export declare function sortByWorktreeRoot(records: readonly AuthorizedWorkspaceRecord[]): AuthorizedWorkspaceRecord[];
+export declare function cloneAuthorizedWorkspaceRecord(record: AuthorizedWorkspaceRecord): AuthorizedWorkspaceRecord;
+export declare function buildStatePath(graftDir: string): string;
+export declare function loadPersistedState(statePath: string, fs: FileSystem, codec: JsonCodec): Promise<PersistedControlPlaneState | null>;
+export declare function persistState(statePath: string, fs: FileSystem, codec: JsonCodec, workspaces: ReadonlyMap<string, AuthorizedWorkspaceRecord>): Promise<void>;
+export {};
+//# sourceMappingURL=authz-storage.d.ts.map

package/dist/mcp/control-plane/authz-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-storage.d.ts","sourceRoot":"","sources":["../../../src/mcp/control-plane/authz-storage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EACV,0BAA0B,EAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAyB5D,QAAA,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;kBAG3B,CAAC;AAEZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAM1F,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,0BAA0B,GAClC,0BAA0B,CAE5B;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,0BAA0B,EAChC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAMT;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,0BAA0B,GAAG,SAAS,EAC/C,cAAc,EAAE,0BAA0B,EAC1C,UAAU,EAAE,OAAO,GAAG,SAAS,GAC9B,0BAA0B,CAK5B;AAMD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,yBAAyB,EAAE,GAAG,yBAAyB,EAAE,CAE7G;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,yBAAyB,GAAG,yBAAyB,CAK3G;AASD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMvD;AAED,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,SAAS,GACf,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAS5C;AAED,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GACzD,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/mcp/control-plane/authz-storage.js

@@ -0,0 +1,85 @@
+import * as path from "node:path";
+import { z } from "zod";
+// ---------------------------------------------------------------------------
+// Zod schemas for persisted authorization state
+// ---------------------------------------------------------------------------
+const workspaceCapabilityProfileSchema = z.object({
+    boundedReads: z.boolean(),
+    structuralTools: z.boolean(),
+    precisionTools: z.boolean(),
+    stateBookmarks: z.boolean(),
+    runtimeLogs: z.literal("session_local_only"),
+    runCapture: z.boolean(),
+}).strict();
+const authorizedWorkspaceRecordSchema = z.object({
+    repoId: z.string(),
+    worktreeId: z.string(),
+    worktreeRoot: z.string(),
+    gitCommonDir: z.string(),
+    capabilityProfile: workspaceCapabilityProfileSchema,
+    authorizedAt: z.string(),
+    lastBoundAt: z.string().nullable(),
+}).strict();
+const persistedControlPlaneStateSchema = z.object({
+    version: z.literal(1),
+    workspaces: z.array(authorizedWorkspaceRecordSchema),
+}).strict();
+// ---------------------------------------------------------------------------
+// Capability profile helpers
+// ---------------------------------------------------------------------------
+export function cloneCapabilityProfile(profile) {
+    return { ...profile };
+}
+export function capabilityProfilesEqual(left, right) {
+    return left.boundedReads === right.boundedReads
+        && left.structuralTools === right.structuralTools
+        && left.precisionTools === right.precisionTools
+        && left.stateBookmarks === right.stateBookmarks
+        && left.runCapture === right.runCapture;
+}
+export function resolveCapabilityProfile(current, defaultProfile, runCapture) {
+    return {
+        ...(current ?? defaultProfile),
+        ...(runCapture !== undefined ? { runCapture } : {}),
+    };
+}
+// ---------------------------------------------------------------------------
+// Record helpers
+// ---------------------------------------------------------------------------
+export function sortByWorktreeRoot(records) {
+    return [...records].sort((left, right) => left.worktreeRoot.localeCompare(right.worktreeRoot));
+}
+export function cloneAuthorizedWorkspaceRecord(record) {
+    return {
+        ...record,
+        capabilityProfile: cloneCapabilityProfile(record.capabilityProfile),
+    };
+}
+// ---------------------------------------------------------------------------
+// Persistence
+// ---------------------------------------------------------------------------
+const CONTROL_PLANE_DIR = "control-plane";
+const AUTHORIZED_WORKSPACES_FILE = "authorized-workspaces.json";
+export function buildStatePath(graftDir) {
+    return path.join(path.resolve(graftDir), CONTROL_PLANE_DIR, AUTHORIZED_WORKSPACES_FILE);
+}
+export async function loadPersistedState(statePath, fs, codec) {
+    const raw = await fs.readFile(statePath, "utf-8").catch((error) => {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+            return null;
+        }
+        throw error;
+    });
+    if (raw === null)
+        return null;
+    return persistedControlPlaneStateSchema.parse(codec.decode(raw));
+}
+export async function persistState(statePath, fs, codec, workspaces) {
+    const payload = {
+        version: 1,
+        workspaces: sortByWorktreeRoot([...workspaces.values()]),
+    };
+    await fs.mkdir(path.dirname(statePath), { recursive: true });
+    await fs.writeFile(statePath, codec.encode(payload), "utf-8");
+}
+//# sourceMappingURL=authz-storage.js.map

package/dist/mcp/control-plane/authz-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-storage.js","sourceRoot":"","sources":["../../../src/mcp/control-plane/authz-storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,iBAAiB,EAAE,gCAAgC;IACnD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC;CACrD,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,MAAM,UAAU,sBAAsB,CACpC,OAAmC;IAEnC,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAgC,EAChC,KAAiC;IAEjC,OAAO,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;WAC1C,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,eAAe;WAC9C,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;WAC5C,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;WAC5C,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAA+C,EAC/C,cAA0C,EAC1C,UAA+B;IAE/B,OAAO;QACL,GAAG,CAAC,OAAO,IAAI,cAAc,CAAC;QAC9B,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,UAAU,kBAAkB,CAAC,OAA6C;IAC9E,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAiC;IAC9E,OAAO;QACL,GAAG,MAAM;QACT,iBAAiB,EAAE,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC;KACpE,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,0BAA0B,GAAG,4BAA4B,CAAC;AAEhE,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,OAAO,IAAI,CAAC,IAAI,CACd,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EACtB,iBAAiB,EACjB,0BAA0B,CAC3B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,EAAc,EACd,KAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACzE,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,EAAc,EACd,KAAgB,EAChB,UAA0D;IAE1D,MAAM,OAAO,GAA+B;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;KACzD,CAAC;IACF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC"}

package/dist/mcp/control-plane/session-registry.d.ts

@@ -0,0 +1,12 @@
+import type { RuntimeCausalContext } from "../runtime-causal-context.js";
+import type { WorkspaceStatus } from "../workspace-router.js";
+import type { DaemonSessionView, RegisteredTransport, SharedAttachSource } from "./types.js";
+export declare function toDaemonSessionView(session: RegisteredTransport, readWorkspaceStatus: (s: RegisteredTransport) => WorkspaceStatus, readRuntimeCausalContext: (s: RegisteredTransport) => RuntimeCausalContext | null): DaemonSessionView;
+export declare function readWorkspaceStatus(session: RegisteredTransport): WorkspaceStatus;
+export declare function readRuntimeCausalContext(session: RegisteredTransport): RuntimeCausalContext | null;
+export declare function resolveSharedAttachSource(sessions: ReadonlyMap<string, RegisteredTransport>, input: {
+    readonly sessionId: string;
+    readonly repoId: string;
+    readonly worktreeId: string;
+}): SharedAttachSource | null;
+//# sourceMappingURL=session-registry.d.ts.map

package/dist/mcp/control-plane/session-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-registry.d.ts","sourceRoot":"","sources":["../../../src/mcp/control-plane/session-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAMpB,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,mBAAmB,EAC5B,mBAAmB,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,eAAe,EAChE,wBAAwB,EAAE,CAAC,CAAC,EAAE,mBAAmB,KAAK,oBAAoB,GAAG,IAAI,GAChF,iBAAiB,CAgBnB;AAMD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,GAAG,eAAe,CAejF;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,mBAAmB,GAAG,oBAAoB,GAAG,IAAI,CAMlG;AAMD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAClD,KAAK,EAAE;IACL,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACA,kBAAkB,GAAG,IAAI,CAuC3B"}

package/dist/mcp/control-plane/session-registry.js

@@ -0,0 +1,88 @@
+import { cloneCapabilityProfile } from "./authz-storage.js";
+// ---------------------------------------------------------------------------
+// Session view projection
+// ---------------------------------------------------------------------------
+export function toDaemonSessionView(session, readWorkspaceStatus, readRuntimeCausalContext) {
+    const status = readWorkspaceStatus(session);
+    const causalContext = readRuntimeCausalContext(session);
+    return {
+        sessionId: session.sessionId,
+        sessionMode: "daemon",
+        bindState: status.bindState,
+        repoId: status.repoId,
+        worktreeId: status.worktreeId,
+        worktreeRoot: status.worktreeRoot,
+        causalSessionId: causalContext?.causalSessionId ?? null,
+        checkoutEpochId: causalContext?.checkoutEpochId ?? null,
+        capabilityProfile: status.capabilityProfile === null ? null : cloneCapabilityProfile(status.capabilityProfile),
+        startedAt: session.startedAt,
+        lastActivityAt: session.lastActivityAt,
+    };
+}
+// ---------------------------------------------------------------------------
+// Workspace status & causal context safe readers
+// ---------------------------------------------------------------------------
+export function readWorkspaceStatus(session) {
+    try {
+        return session.getWorkspaceStatus();
+    }
+    catch {
+        return {
+            sessionMode: "daemon",
+            bindState: "unbound",
+            repoId: null,
+            worktreeId: null,
+            worktreeRoot: null,
+            gitCommonDir: null,
+            graftDir: null,
+            capabilityProfile: null,
+        };
+    }
+}
+export function readRuntimeCausalContext(session) {
+    try {
+        return session.getRuntimeCausalContext();
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Shared attach resolution
+// ---------------------------------------------------------------------------
+export function resolveSharedAttachSource(sessions, input) {
+    const candidates = [...sessions.values()]
+        .filter((session) => session.sessionId !== input.sessionId)
+        .flatMap((session) => {
+        const status = readWorkspaceStatus(session);
+        if (status.bindState !== "bound" ||
+            status.repoId !== input.repoId ||
+            status.worktreeId !== input.worktreeId) {
+            return [];
+        }
+        const causalContext = readRuntimeCausalContext(session);
+        if (causalContext === null) {
+            return [];
+        }
+        return [{
+                sourceSessionId: session.sessionId,
+                causalSessionId: causalContext.causalSessionId,
+                strandId: causalContext.strandId,
+                lastActivityAt: session.lastActivityAt,
+            }];
+    })
+        .sort((left, right) => right.lastActivityAt.localeCompare(left.lastActivityAt));
+    if (candidates.length !== 1) {
+        return null;
+    }
+    const [source] = candidates;
+    if (source === undefined) {
+        return null;
+    }
+    return {
+        sourceSessionId: source.sourceSessionId,
+        causalSessionId: source.causalSessionId,
+        strandId: source.strandId,
+    };
+}
+//# sourceMappingURL=session-registry.js.map

package/dist/mcp/control-plane/session-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-registry.js","sourceRoot":"","sources":["../../../src/mcp/control-plane/session-registry.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAO5D,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CACjC,OAA4B,EAC5B,mBAAgE,EAChE,wBAAiF;IAEjF,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,QAAQ;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,eAAe,EAAE,aAAa,EAAE,eAAe,IAAI,IAAI;QACvD,eAAe,EAAE,aAAa,EAAE,eAAe,IAAI,IAAI;QACvD,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC9G,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,UAAU,mBAAmB,CAAC,OAA4B;IAC9D,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,kBAAkB,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,WAAW,EAAE,QAAQ;YACrB,SAAS,EAAE,SAAS;YACpB,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;YACd,iBAAiB,EAAE,IAAI;SACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAA4B;IACnE,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CACvC,QAAkD,EAClD,KAIC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;SACtC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC;SAC1D,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnB,MAAM,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAC5C,IACE,MAAM,CAAC,SAAS,KAAK,OAAO;YAC5B,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAC9B,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EACtC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAC;gBACN,eAAe,EAAE,OAAO,CAAC,SAAS;gBAClC,eAAe,EAAE,aAAa,CAAC,eAAe;gBAC9C,QAAQ,EAAE,aAAa,CAAC,QAAQ;gBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;IACL,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAElF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC"}

package/dist/mcp/control-plane/status-projection.d.ts

@@ -0,0 +1,8 @@
+import type { DaemonSchedulerCounts } from "../daemon-job-scheduler.js";
+import type { DaemonWorkerCounts } from "../daemon-worker-pool.js";
+import type { WorkspaceCapabilityProfile } from "../workspace-router.js";
+import type { AuthorizedWorkspaceRecord, AuthorizedWorkspaceView, DaemonMonitorCounts, DaemonRuntimeDescriptor, DaemonSessionView, DaemonStatusView } from "./types.js";
+export declare const ZERO_MONITOR_COUNTS: DaemonMonitorCounts;
+export declare function buildStatusView(runtime: DaemonRuntimeDescriptor, sessions: readonly DaemonSessionView[], authorizedWorkspaces: ReadonlyMap<string, AuthorizedWorkspaceRecord>, defaultCapabilityProfile: WorkspaceCapabilityProfile, monitorCounts: DaemonMonitorCounts, schedulerCounts: DaemonSchedulerCounts, workerCounts: DaemonWorkerCounts): DaemonStatusView;
+export declare function toAuthorizedWorkspaceView(record: AuthorizedWorkspaceRecord, activeSessionCount: number): AuthorizedWorkspaceView;
+//# sourceMappingURL=status-projection.d.ts.map

package/dist/mcp/control-plane/status-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-projection.d.ts","sourceRoot":"","sources":["../../../src/mcp/control-plane/status-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEzE,OAAO,KAAK,EACV,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAMpB,eAAO,MAAM,mBAAmB,EAAE,mBAOhC,CAAC;AAMH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,uBAAuB,EAChC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,oBAAoB,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,EACpE,wBAAwB,EAAE,0BAA0B,EACpD,aAAa,EAAE,mBAAmB,EAClC,eAAe,EAAE,qBAAqB,EACtC,YAAY,EAAE,kBAAkB,GAC/B,gBAAgB,CAsBlB;AAMD,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,yBAAyB,EACjC,kBAAkB,EAAE,MAAM,GACzB,uBAAuB,CAMzB"}

package/dist/mcp/control-plane/status-projection.js

@@ -0,0 +1,49 @@
+import { cloneCapabilityProfile } from "./authz-storage.js";
+// ---------------------------------------------------------------------------
+// Zero-value defaults
+// ---------------------------------------------------------------------------
+export const ZERO_MONITOR_COUNTS = Object.freeze({
+    totalMonitors: 0,
+    runningMonitors: 0,
+    pausedMonitors: 0,
+    stoppedMonitors: 0,
+    failingMonitors: 0,
+    backlogMonitors: 0,
+});
+// ---------------------------------------------------------------------------
+// Status view assembly
+// ---------------------------------------------------------------------------
+export function buildStatusView(runtime, sessions, authorizedWorkspaces, defaultCapabilityProfile, monitorCounts, schedulerCounts, workerCounts) {
+    const boundSessions = sessions.filter((session) => session.bindState === "bound").length;
+    return {
+        ok: true,
+        sessionMode: "daemon",
+        activeSessions: sessions.length,
+        boundSessions,
+        unboundSessions: sessions.length - boundSessions,
+        authorizedWorkspaces: authorizedWorkspaces.size,
+        authorizedRepos: new Set([...authorizedWorkspaces.values()].map((record) => record.repoId)).size,
+        workspaceBindRequiresAuthorization: true,
+        defaultCapabilityProfile: cloneCapabilityProfile(defaultCapabilityProfile),
+        totalMonitors: monitorCounts.totalMonitors,
+        runningMonitors: monitorCounts.runningMonitors,
+        pausedMonitors: monitorCounts.pausedMonitors,
+        stoppedMonitors: monitorCounts.stoppedMonitors,
+        failingMonitors: monitorCounts.failingMonitors,
+        backlogMonitors: monitorCounts.backlogMonitors,
+        scheduler: schedulerCounts,
+        workers: workerCounts,
+        ...runtime,
+    };
+}
+// ---------------------------------------------------------------------------
+// Authorized workspace view projection
+// ---------------------------------------------------------------------------
+export function toAuthorizedWorkspaceView(record, activeSessionCount) {
+    return {
+        ...record,
+        capabilityProfile: cloneCapabilityProfile(record.capabilityProfile),
+        activeSessions: activeSessionCount,
+    };
+}
+//# sourceMappingURL=status-projection.js.map

package/dist/mcp/control-plane/status-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-projection.js","sourceRoot":"","sources":["../../../src/mcp/control-plane/status-projection.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAU5D,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAwB,MAAM,CAAC,MAAM,CAAC;IACpE,aAAa,EAAE,CAAC;IAChB,eAAe,EAAE,CAAC;IAClB,cAAc,EAAE,CAAC;IACjB,eAAe,EAAE,CAAC;IAClB,eAAe,EAAE,CAAC;IAClB,eAAe,EAAE,CAAC;CACnB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,UAAU,eAAe,CAC7B,OAAgC,EAChC,QAAsC,EACtC,oBAAoE,EACpE,wBAAoD,EACpD,aAAkC,EAClC,eAAsC,EACtC,YAAgC;IAEhC,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACzF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,WAAW,EAAE,QAAQ;QACrB,cAAc,EAAE,QAAQ,CAAC,MAAM;QAC/B,aAAa;QACb,eAAe,EAAE,QAAQ,CAAC,MAAM,GAAG,aAAa;QAChD,oBAAoB,EAAE,oBAAoB,CAAC,IAAI;QAC/C,eAAe,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;QAChG,kCAAkC,EAAE,IAAI;QACxC,wBAAwB,EAAE,sBAAsB,CAAC,wBAAwB,CAAC;QAC1E,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,eAAe,EAAE,aAAa,CAAC,eAAe;QAC9C,cAAc,EAAE,aAAa,CAAC,cAAc;QAC5C,eAAe,EAAE,aAAa,CAAC,eAAe;QAC9C,eAAe,EAAE,aAAa,CAAC,eAAe;QAC9C,eAAe,EAAE,aAAa,CAAC,eAAe;QAC9C,SAAS,EAAE,eAAe;QAC1B,OAAO,EAAE,YAAY;QACrB,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CACvC,MAAiC,EACjC,kBAA0B;IAE1B,OAAO;QACL,GAAG,MAAM;QACT,iBAAiB,EAAE,sBAAsB,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACnE,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC"}

package/dist/mcp/control-plane/types.d.ts

@@ -0,0 +1,107 @@
+import type { DaemonSchedulerCounts } from "../daemon-job-scheduler.js";
+import type { DaemonWorkerCounts } from "../daemon-worker-pool.js";
+import type { RuntimeCausalContext } from "../runtime-causal-context.js";
+import type { WorkspaceBindRequest, WorkspaceCapabilityProfile, WorkspaceStatus } from "../workspace-router.js";
+export interface RegisteredTransport {
+    readonly sessionId: string;
+    readonly startedAt: string;
+    readonly getWorkspaceStatus: () => WorkspaceStatus;
+    readonly getRuntimeCausalContext: () => RuntimeCausalContext | null;
+    lastActivityAt: string;
+}
+export interface AuthorizedWorkspaceRecord {
+    readonly repoId: string;
+    readonly worktreeId: string;
+    readonly worktreeRoot: string;
+    readonly gitCommonDir: string;
+    readonly capabilityProfile: WorkspaceCapabilityProfile;
+    readonly authorizedAt: string;
+    readonly lastBoundAt: string | null;
+}
+export interface AuthorizedWorkspaceView extends AuthorizedWorkspaceRecord {
+    readonly activeSessions: number;
+}
+export interface WorkspaceAuthorizeRequest extends WorkspaceBindRequest {
+    readonly runCapture?: boolean | undefined;
+}
+export interface WorkspaceAuthorizeResult {
+    readonly ok: boolean;
+    readonly changed: boolean;
+    readonly authorization?: AuthorizedWorkspaceView;
+    readonly errorCode?: string;
+    readonly error?: string;
+}
+export interface WorkspaceRevokeResult {
+    readonly ok: boolean;
+    readonly revoked: boolean;
+    readonly repoId?: string | null;
+    readonly worktreeId?: string | null;
+    readonly worktreeRoot?: string | null;
+    readonly activeSessions?: number;
+    readonly errorCode?: string;
+    readonly error?: string;
+}
+export interface DaemonSessionView {
+    readonly sessionId: string;
+    readonly sessionMode: "daemon";
+    readonly bindState: WorkspaceStatus["bindState"];
+    readonly repoId: string | null;
+    readonly worktreeId: string | null;
+    readonly worktreeRoot: string | null;
+    readonly causalSessionId: string | null;
+    readonly checkoutEpochId: string | null;
+    readonly capabilityProfile: WorkspaceCapabilityProfile | null;
+    readonly startedAt: string;
+    readonly lastActivityAt: string;
+}
+export interface DaemonRuntimeDescriptor {
+    readonly transport: "unix_socket" | "named_pipe";
+    readonly sameUserOnly: true;
+    readonly socketPath: string;
+    readonly mcpPath: string;
+    readonly healthPath: string;
+    readonly activeWarpRepos: number;
+    readonly startedAt: string;
+}
+export interface SharedAttachSource {
+    readonly sourceSessionId: string;
+    readonly causalSessionId: string;
+    readonly strandId: string;
+}
+export interface DaemonMonitorCounts {
+    readonly totalMonitors: number;
+    readonly runningMonitors: number;
+    readonly pausedMonitors: number;
+    readonly stoppedMonitors: number;
+    readonly failingMonitors: number;
+    readonly backlogMonitors: number;
+}
+export interface DaemonStatusView extends DaemonRuntimeDescriptor {
+    readonly ok: true;
+    readonly sessionMode: "daemon";
+    readonly activeSessions: number;
+    readonly boundSessions: number;
+    readonly unboundSessions: number;
+    readonly authorizedWorkspaces: number;
+    readonly authorizedRepos: number;
+    readonly workspaceBindRequiresAuthorization: true;
+    readonly defaultCapabilityProfile: WorkspaceCapabilityProfile;
+    readonly totalMonitors: number;
+    readonly runningMonitors: number;
+    readonly pausedMonitors: number;
+    readonly stoppedMonitors: number;
+    readonly failingMonitors: number;
+    readonly backlogMonitors: number;
+    readonly scheduler: DaemonSchedulerCounts;
+    readonly workers: DaemonWorkerCounts;
+}
+export interface DaemonControlPlaneOptions {
+    readonly fs: FileSystem;
+    readonly codec: JsonCodec;
+    readonly git: GitClient;
+    readonly graftDir: string;
+}
+import type { FileSystem } from "../../ports/filesystem.js";
+import type { JsonCodec } from "../../ports/codec.js";
+import type { GitClient } from "../../ports/git.js";
+//# sourceMappingURL=types.d.ts.map

package/dist/mcp/control-plane/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/mcp/control-plane/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAMhC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,eAAe,CAAC;IACnD,QAAQ,CAAC,uBAAuB,EAAE,MAAM,oBAAoB,GAAG,IAAI,CAAC;IACpE,cAAc,EAAE,MAAM,CAAC;CACxB;AAMD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB;IACxE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,yBAA0B,SAAQ,oBAAoB;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,uBAAuB,CAAC;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,WAAW,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,iBAAiB,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAMD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,aAAa,GAAG,YAAY,CAAC;IACjD,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,gBAAiB,SAAQ,uBAAuB;IAC/D,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,kCAAkC,EAAE,IAAI,CAAC;IAClD,QAAQ,CAAC,wBAAwB,EAAE,0BAA0B,CAAC;IAC9D,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;CACtC;AAMD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/mcp/control-plane/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/mcp/control-plane/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/mcp/control-plane/types.ts"],"names":[],"mappings":""}

package/dist/mcp/daemon-bootstrap.d.ts

@@ -0,0 +1,9 @@
+import * as http from "node:http";
+export declare function isNamedPipePath(socketPath: string): boolean;
+export declare function defaultDaemonRoot(): string;
+export declare function resolveSocketPath(socketPath: string | undefined, graftDir: string): string;
+export declare function ensurePrivateDirectory(dirPath: string): Promise<void>;
+export declare function prepareSocketPath(socketPath: string): Promise<void>;
+export declare function tightenSocketPermissions(socketPath: string): Promise<void>;
+export declare function closeHttpServer(server: http.Server): Promise<void>;
+//# sourceMappingURL=daemon-bootstrap.d.ts.map

package/dist/mcp/daemon-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-bootstrap.d.ts","sourceRoot":"","sources":["../../src/mcp/daemon-bootstrap.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAQlC,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAUD,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAI1F;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E;AA0BD,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAezE;AAED,wBAAsB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhF;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUxE"}

package/dist/mcp/daemon-bootstrap.js

@@ -0,0 +1,96 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as http from "node:http";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+const DIRECTORY_MODE = 0o700;
+const SOCKET_MODE = 0o600;
+export function isNamedPipePath(socketPath) {
+    return process.platform === "win32" && socketPath.startsWith("\\\\.\\pipe\\");
+}
+export function defaultDaemonRoot() {
+    return path.join(os.homedir(), ".graft", "daemon");
+}
+function defaultSocketPath(graftDir) {
+    if (process.platform === "win32") {
+        const digest = crypto.createHash("sha256").update(os.homedir()).digest("hex").slice(0, 12);
+        return `\\\\.\\pipe\\graft-daemon-${digest}`;
+    }
+    return path.join(graftDir, "mcp.sock");
+}
+export function resolveSocketPath(socketPath, graftDir) {
+    if (socketPath === undefined)
+        return defaultSocketPath(graftDir);
+    if (isNamedPipePath(socketPath))
+        return socketPath;
+    return path.resolve(socketPath);
+}
+export async function ensurePrivateDirectory(dirPath) {
+    await fs.mkdir(dirPath, { recursive: true, mode: DIRECTORY_MODE });
+    if (process.platform !== "win32") {
+        await fs.chmod(dirPath, DIRECTORY_MODE).catch(() => {
+            return undefined;
+        });
+    }
+}
+async function socketHasActiveListener(socketPath) {
+    return new Promise((resolve) => {
+        const socket = net.createConnection({ path: socketPath });
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolve(result);
+        };
+        socket.once("connect", () => {
+            finish(true);
+        });
+        socket.once("error", () => {
+            finish(false);
+        });
+        socket.setTimeout(200, () => {
+            finish(false);
+        });
+    });
+}
+export async function prepareSocketPath(socketPath) {
+    if (isNamedPipePath(socketPath))
+        return;
+    await ensurePrivateDirectory(path.dirname(socketPath));
+    const existing = await fs.lstat(socketPath).catch((error) => {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return null;
+        throw error;
+    });
+    if (existing === null)
+        return;
+    if (!existing.isSocket()) {
+        throw new Error(`Refusing to overwrite non-socket path: ${socketPath}`);
+    }
+    if (await socketHasActiveListener(socketPath)) {
+        throw new Error(`A graft daemon is already listening on ${socketPath}`);
+    }
+    await fs.unlink(socketPath);
+}
+export async function tightenSocketPermissions(socketPath) {
+    if (process.platform === "win32" || isNamedPipePath(socketPath))
+        return;
+    await fs.chmod(socketPath, SOCKET_MODE).catch(() => {
+        return undefined;
+    });
+}
+export async function closeHttpServer(server) {
+    await new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve();
+        });
+    });
+}
+//# sourceMappingURL=daemon-bootstrap.js.map