@foldkit/devtools-mcp 0.24.0 → 0.24.1-canary.060271955cc2

package/README.md

@@ -51,6 +51,14 @@ Restart your dev server, then restart your AI agent. The MCP server will appear
 
 The browser bridge runs inside your app, so the MCP server only sees a Runtime while the app is open in a browser tab. Close the tab and the Runtime disappears from `foldkit_list_runtimes`.
 
+## Sensitive Runtime Data
+
+Treat this server as privileged access to the running application. A connected agent can read the current, initial, and retained historical Models; every retained Message payload; and the arguments passed to recorded Commands and Mounts. Anything returned by one of these tools enters the agent's context.
+
+Keep API keys, passwords, access and refresh tokens, authorization headers, session material, and private personal data out of those values. Long-lived secrets belong behind a server boundary, including in local demos. If the browser must temporarily carry a sensitive value, use Effect `Redacted` with a `Schema.Redacted` field configured with `disallowJsonEncode: true`. `Redacted` protects normal string, JSON, and inspection output; it does not encrypt the value or hide a browser-side credential from the person running the browser.
+
+`excludeFromHistory` is for noisy Messages, not sensitive ones. The resulting Model remains inspectable. Omitting `DevToolsConfig.Message` disables dispatch only; read and replay tools remain available. Set `devToolsMcpPort: false` in the Foldkit Vite plugin options to keep the in-browser DevTools without starting the MCP relay, or set `devTools: false` in the application config to disable recording and the browser bridge too.
+
 ## Tools
 
 Each tool accepts an optional `runtime_id`. When omitted, the most recently connected Runtime is used.
@@ -110,7 +118,7 @@ The MCP server looks for a running dev server in its project directory. If sever
 | `FOLDKIT_DEVTOOLS_MCP_HOST`        | Overrides the hostname of a discovered relay or configured port.                                                                                                            |
 | `FOLDKIT_DEVTOOLS_RELAY_DIRECTORY` | Registry location. Defaults to a directory under `XDG_RUNTIME_DIR` when set, or under the OS temporary directory. Set it in both processes if they use different sandboxes. |
 
-A relay discovered through the registry requires the token in its published address. The plugin will not publish that token into a directory owned by another user or readable by other users. A configured `devToolsMcpPort` opens a separate socket on every interface without a token.
+A relay discovered through the registry requires the token in its published address. The plugin will not publish that token into a directory owned by another user or readable by other users. This token keeps unapproved clients from connecting; it does not hide runtime data from the agent that was given the MCP server. A configured `devToolsMcpPort` opens a separate socket on every interface without a token. Do not use a fixed port on a shared or untrusted network.
 
 On Windows, directory ownership cannot be verified, so automatic discovery is unavailable. Use `devToolsMcpPort` in the Vite config and set `FOLDKIT_DEVTOOLS_MCP_PORT` to the same port.
 

package/dist/server.js

@@ -17513,6 +17513,37 @@ function decodeUnknownExit(schema, options) {
 	};
 }
 /**
+* Decodes a typed input (the schema's `Encoded` type) against a schema
+* synchronously, returning an `Exit` that is either a `Success` with the decoded
+* value or a `Failure`.
+*
+* **When to use**
+*
+* Use when you need to decode already typed `Encoded` input into an `Exit` and
+* capture schema mismatches as `SchemaError`.
+*
+* **Details**
+*
+* Only usable with schemas that have no `DecodingServices` requirement. For
+* `unknown` input use {@link decodeUnknownExit}.
+* Options may be provided either when creating the decoder or when applying it;
+* application options override creation options.
+* Schema mismatches are represented by a `Failure` cause containing
+* `SchemaError`.
+*
+* **Gotchas**
+*
+* Schema issue fail reasons are wrapped as `SchemaError`. Defects,
+* interruptions, and other non-schema reasons remain in the returned `Cause`,
+* including when they are mixed with schema issues.
+*
+* @see {@link SchemaParser.decodeExit} for the adapter whose failure contains `SchemaIssue.Issue` directly
+*
+* @category decoding
+* @since 4.0.0
+*/
+const decodeExit = decodeUnknownExit;
+/**
 * Decodes an `unknown` input against a schema, returning an `Option` that is
 * `Some` with the decoded value on success or `None` for schema mismatches.
 *
@@ -42476,7 +42507,7 @@ const connectWebSocketClient = (resolveUrl) => gen(function* () {
 	};
 });
 const handleIncomingMessage = (raw, pendingResponsesRef) => {
-	const decoded = decodeUnknownExit(fromJsonString(ResponseFrame))(raw.toString());
+	const decoded = decodeExit(fromJsonString(ResponseFrame))(raw.toString());
 	return match(decoded, {
 		onFailure: (error) => sync(() => console.error("[foldkit-devtools-mcp] failed to decode frame", error)),
 		onSuccess: (responseFrame) => gen(function* () {

package/dist/webSocketClient.js

@@ -116,7 +116,7 @@ export const connectWebSocketClient = (resolveUrl) => Effect.gen(function* () {
     return { sendRequest, close };
 });
 const handleIncomingMessage = (raw, pendingResponsesRef) => {
-    const decoded = Schema.decodeUnknownExit(Schema.fromJsonString(ResponseFrame))(raw.toString());
+    const decoded = Schema.decodeExit(Schema.fromJsonString(ResponseFrame))(raw.toString());
     return Exit.match(decoded, {
         onFailure: error => Effect.sync(() => console.error('[foldkit-devtools-mcp] failed to decode frame', error)),
         onSuccess: responseFrame => Effect.gen(function* () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldkit/devtools-mcp",
-  "version": "0.24.0",
+  "version": "0.24.1-canary.060271955cc2",
   "description": "MCP server exposing Foldkit DevTools to AI agents (Claude Code, Cursor, etc.)",
   "type": "module",
   "main": "./dist/server.js",
@@ -17,7 +17,7 @@
   },
   "peerDependencies": {
     "effect": "4.0.0",
-    "foldkit": ">=0.165.0"
+    "foldkit": "0.168.0-canary.060271955cc2"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.29.0",
@@ -25,16 +25,16 @@
   },
   "devDependencies": {
     "@effect/platform-node": "4.0.0",
+    "@foldkit/vite-plugin": "0.27.1-canary.060271955cc2",
     "@types/node": "26.4.0",
     "@types/ws": "^8.18.1",
     "effect": "4.0.0",
+    "foldkit": "0.168.0-canary.060271955cc2",
     "rimraf": "^6.1.3",
     "rolldown": "^1.2.11",
     "typescript": "^7.0.2",
     "vite": "^8.3.1",
-    "vitest": "^4.1.11",
-    "@foldkit/vite-plugin": "0.26.0",
-    "foldkit": "0.165.0"
+    "vitest": "^4.1.11"
   },
   "files": [
     "dist"