@foldrun/core 0.2.0

package/src/agent-tools.ts

@@ -0,0 +1,138 @@
+// Agent-as-tool: consult a colleague without ending your turn.
+//
+//   agents: [researcher]        # in agent.md frontmatter
+//
+// gives the agent one tool per named colleague — consult_researcher(question)
+// — that runs that agent's persona as a one-shot, toolless model call and
+// returns its answer inline. "Toolless" is the design, not a shortcut: a
+// consult is asking a specialist what they think, and a consultant who could
+// edit files or call APIs mid-question would be the supervisor pattern the
+// spec rejects, wearing a different hat. Depth is structurally one — the
+// callee is built without an agents server of its own.
+//
+// The flow file still owns the orchestration: who may be consulted is
+// declared per agent, cost lands on the consulting step, and nothing about
+// what runs next is decided by a model.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import matter from "gray-matter";
+import { z } from "zod";
+import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
+import { resolveModel, resolveEffort, type Effort } from "./store.ts";
+import { executeStep } from "./step-exec.ts";
+import { refNames } from "./refs.ts";
+
+export interface ConsultSpec {
+  name: string;
+  systemPrompt: string;
+  model: string;
+  /** A colleague answers at its own declared effort, not the caller's — the
+   *  point of consulting one is that it is configured differently. */
+  effort: Effort | null;
+}
+
+
+/**
+ * Read the consultable colleagues' personas, host-side. Names that don't
+ * resolve to an agent are reported, not silently dropped.
+ */
+export function gatherConsults(
+  workspaceRoot: string,
+  names: unknown,
+): { consults: ConsultSpec[]; missing: string[] } {
+  const list = refNames(names);
+  const consults: ConsultSpec[] = [];
+  const missing: string[] = [];
+  for (const name of list) {
+    const file = path.join(workspaceRoot, "agents", name, "agent.md");
+    if (!/^[a-z0-9]+(-[a-z0-9]+)*$/.test(name) || !fs.existsSync(file)) {
+      missing.push(name);
+      continue;
+    }
+    const parsed = matter(fs.readFileSync(file, "utf8"));
+    consults.push({
+      name,
+      systemPrompt:
+        `${parsed.content.trim()}\n\n` +
+        `You are being consulted by another agent mid-task. Answer the question ` +
+        `directly and completely in your reply — you have no tools and no files; ` +
+        `everything you know is in this prompt and the question.`,
+      model: resolveModel((parsed.data as { model?: string }).model),
+      effort: resolveEffort((parsed.data as { effort?: string }).effort),
+    });
+  }
+  return { consults, missing };
+}
+
+export interface ConsultToolResult {
+  /** Passed to the SDK as an in-process MCP server (the agent just sees tools). */
+  server: ReturnType<typeof createSdkMcpServer> | null;
+  toolNames: string[];
+  /** Model spend by the consults so far — the caller adds it to its step. */
+  drainCost: () => number;
+}
+
+/**
+ * The MCP server carrying one consult_<name> tool per colleague. Works in
+ * both homes — the server process and the runner container — because it
+ * takes values, not stores.
+ */
+export function buildConsultTools(
+  consults: ConsultSpec[],
+  env: Record<string, string | undefined>,
+  emit: (type: "info" | "error", text: string) => void,
+): ConsultToolResult {
+  if (consults.length === 0) return { server: null, toolNames: [], drainCost: () => 0 };
+  let cost = 0;
+
+  const tools = consults.map((c) =>
+    tool(
+      `consult_${c.name.replaceAll("-", "_")}`,
+      `Ask ${c.name} — a colleague agent — one question and get their answer inline. ` +
+        `They see only your question, not your files or conversation; include everything they need in it.`,
+      { question: z.string().describe("The complete, self-contained question") },
+      async (args) => {
+        const started = Date.now();
+        // Toolless and homeless on purpose: the consult reads and writes
+        // nothing — cwd is a throwaway so even a confused model call has no
+        // tree to touch (and no tools to touch it with).
+        const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-consult-"));
+        try {
+          const outcome = await executeStep({
+            agentDir: scratch,
+            workspaceRoot: scratch,
+            libraryRoot: scratch,
+            prompt: args.question,
+            model: c.model,
+            effort: c.effort,
+            systemPrompt: c.systemPrompt,
+            allowed: [],
+            mcpNames: [],
+            mcpServers: {},
+            env,
+            emit: () => {}, // the consult's inner monologue stays its own
+          });
+          cost += outcome.costUsd ?? 0;
+          emit(
+            "info",
+            `consult ${c.name} → ${outcome.status} ($${(outcome.costUsd ?? 0).toFixed(4)}, ${Date.now() - started}ms)`,
+          );
+          return {
+            content: [{ type: "text" as const, text: outcome.result ?? "(no answer)" }],
+            isError: outcome.status === "failed",
+          };
+        } finally {
+          fs.rmSync(scratch, { recursive: true, force: true });
+        }
+      },
+    ),
+  );
+
+  return {
+    server: createSdkMcpServer({ name: "foldrun_agents", version: "1.0.0", tools }),
+    toolNames: consults.map((c) => `mcp__foldrun_agents__consult_${c.name.replaceAll("-", "_")}`),
+    drainCost: () => cost,
+  };
+}

package/src/agents-md.ts

@@ -0,0 +1,81 @@
+// Editing AGENTS.md frontmatter one key at a time, in place.
+//
+// AGENTS.md is a file people write by hand — comments, spacing, key order
+// are theirs. A settings form that re-serialised the whole frontmatter
+// would erase all of that on the first Save. So a key is replaced
+// textually: its block (the `key:` line and the indented lines under it)
+// is cut out, and the new block is appended where it stood. Everything
+// else in the file is untouched. Null removes the key.
+
+import fs from "node:fs";
+import path from "node:path";
+import matter from "gray-matter";
+
+const FRONT = /^(---\r?\n)([\s\S]*?)(\r?\n---)(\r?\n|$)/;
+
+/** The frontmatter of a directory's AGENTS.md (or project.md), or {}. */
+export function readAgentsMdKeys(dir: string): Record<string, unknown> {
+  for (const name of ["AGENTS.md", "project.md"]) {
+    const file = path.join(dir, name);
+    if (!fs.existsSync(file)) continue;
+    try {
+      return (matter(fs.readFileSync(file, "utf8")).data ?? {}) as Record<string, unknown>;
+    } catch {
+      return {};
+    }
+  }
+  return {};
+}
+
+/** One key as YAML lines, the way gray-matter writes frontmatter — the same
+ *  serialiser that already reads these files, so nothing new to disagree. */
+function dumpKey(key: string, value: unknown): string[] {
+  const block = matter.stringify("", { [key]: value });
+  const m = block.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  return (m ? m[1] : `${key}: ${String(value)}`).trimEnd().split("\n");
+}
+
+/** The text of `content` with each key in `patch` replaced (or removed for
+ *  null), everything else byte for byte as it was. A file with no
+ *  frontmatter gets one. */
+export function patchFrontmatter(content: string, patch: Record<string, unknown | null>): string {
+  const m = content.match(FRONT);
+  let open = "---\n";
+  let body = "";
+  let close = "\n---";
+  let rest = content;
+  if (m) {
+    [, open, body, close] = m;
+    rest = content.slice(m[0].length - (m[4] ?? "").length);
+  } else {
+    rest = content.startsWith("\n") ? content : `\n${content}`;
+  }
+  let lines = body === "" ? [] : body.split("\n");
+  for (const [key, value] of Object.entries(patch)) {
+    const at = lines.findIndex((l) => new RegExp(`^${key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*:`).test(l));
+    let end = at;
+    if (at !== -1) {
+      end = at + 1;
+      // The block continues while lines are indented or blank-inside-block.
+      while (end < lines.length && (/^[ \t]/.test(lines[end]) || lines[end].trim() === "")) end++;
+      // A blank line at the block's foot belongs to what follows.
+      while (end > at + 1 && lines[end - 1].trim() === "") end--;
+    }
+    const replacement = value === null || value === undefined ? [] : dumpKey(key, value);
+    if (at === -1) lines = [...lines, ...replacement];
+    else lines = [...lines.slice(0, at), ...replacement, ...lines.slice(end)];
+  }
+  const front = lines.length ? `${open}${lines.join("\n")}${close}` : "";
+  if (!front) return rest.replace(/^(\r?\n)+/, "");
+  return `${front}${m ? m[4] ?? "\n" : "\n"}${rest.replace(/^\r?\n/, m ? "" : "")}`;
+}
+
+/** Apply a frontmatter patch to a directory's AGENTS.md, creating the file
+ *  when the directory has none. Returns the new content. */
+export function setAgentsMdKeys(dir: string, patch: Record<string, unknown | null>): string {
+  const file = path.join(dir, "AGENTS.md");
+  const before = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+  const after = patchFrontmatter(before, patch);
+  fs.writeFileSync(file, after);
+  return after;
+}

package/src/api-tools.ts

@@ -0,0 +1,389 @@
+// Turns an agent's `apis:` declarations into real tools it can call.
+//
+// One generic tool per API, named `call_<api>`: the agent supplies a method,
+// path, optional query and body. When the API declares an `openapi:`
+// document, each of its operations becomes a typed tool of its own,
+// `<api>_<operationId>`, whose arguments are the parameters the document
+// declares — path parameters filled into the template by the platform,
+// query and header parameters routed to where they belong.
+//
+// Either way the platform resolves ${SECRET} placeholders from the encrypted
+// store, enforces the declared base URL and method allowlist, and returns
+// status + body. Credentials never enter the agent's context — it sees the
+// tool, not the token. A `rate:` on the API is a token bucket per step:
+// a call over the limit waits for its turn rather than failing.
+
+import crypto from "node:crypto";
+import { EGRESS_ENV, viaEgress } from "./egress.ts";
+import { z } from "zod";
+import { createSdkMcpServer, tool, type SdkMcpToolDefinition } from "@anthropic-ai/claude-agent-sdk";
+import type { ApiSpec } from "./store.ts";
+import type { OperationSpec } from "./openapi.ts";
+import { resolveSecrets, materializeSecrets } from "./secrets.ts";
+
+const MAX_BODY_CHARS = 20_000;
+/** MCP tool names are capped; ours also carry the server prefix on the wire. */
+const MAX_TOOL_NAME = 64;
+/** How many typed tools the prompt lists by name before summarising. */
+const PROMPT_LIST_CAP = 40;
+/** A wait shorter than this is not worth a word in the log. */
+const LOG_WAIT_MS = 1000;
+
+function substitute(value: string, env: Record<string, string>) {
+  return value.replace(/\$\{([A-Z][A-Z0-9_]*)\}/g, (whole, name: string) => env[name] ?? whole);
+}
+
+// Which secret names does this API's config reference?
+export function secretsUsedByApi(api: ApiSpec): string[] {
+  const found = new Set<string>();
+  for (const value of [...Object.values(api.headers), ...Object.values(api.query)]) {
+    for (const m of value.matchAll(/\$\{([A-Z][A-Z0-9_]*)\}/g)) found.add(m[1]);
+  }
+  return [...found];
+}
+
+/**
+ * A token bucket: `count` tokens, refilled at `perSec`. `take()` resolves
+ * when a token is available, in arrival order — a caller never learns "no",
+ * only "not yet". Lives as long as the tool set does, which is one step.
+ */
+export class TokenBucket {
+  private readonly count: number;
+  private readonly perSec: number;
+  private tokens: number;
+  private last = Date.now();
+  private chain: Promise<void> = Promise.resolve();
+
+  constructor(count: number, perSec: number) {
+    this.count = count;
+    this.perSec = perSec;
+    this.tokens = count;
+  }
+
+  private refill() {
+    const now = Date.now();
+    this.tokens = Math.min(this.count, this.tokens + ((now - this.last) / 1000) * this.perSec);
+    this.last = now;
+  }
+
+  /** Resolves with the milliseconds waited. */
+  take(): Promise<number> {
+    const started = Date.now();
+    const turn = this.chain.then(async () => {
+      for (;;) {
+        this.refill();
+        if (this.tokens >= 1) {
+          this.tokens -= 1;
+          return;
+        }
+        const wait = Math.ceil(((1 - this.tokens) / this.perSec) * 1000);
+        await new Promise((r) => setTimeout(r, Math.max(1, wait)));
+      }
+    });
+    // The queue must survive one caller's failure (there is none today, but
+    // a rejected link would freeze every later call behind it).
+    this.chain = turn.catch(() => {});
+    return turn.then(() => Date.now() - started);
+  }
+}
+
+/** `<api>_<operation>`, held under the MCP cap: a long name keeps its head
+ *  and gains a hash tail, so two long names never collapse into one. */
+export function typedToolName(apiName: string, opId: string): string {
+  const full = `${apiName}_${opId}`;
+  if (full.length <= MAX_TOOL_NAME) return full;
+  const hash = crypto.createHash("sha256").update(full).digest("hex").slice(0, 8);
+  return `${full.slice(0, MAX_TOOL_NAME - hash.length - 1)}_${hash}`;
+}
+
+export interface ApiToolResult {
+  /** Passed to the SDK as an in-process MCP server (the agent just sees tools). */
+  server: ReturnType<typeof createSdkMcpServer> | null;
+  /** Tool names to allow, e.g. mcp__foldrun_apis__call_google_ads. */
+  toolNames: string[];
+  /** Secrets referenced but not set — surfaced as run warnings. */
+  missingSecrets: string[];
+  /** Human-readable lines describing each API, appended to the system prompt. */
+  promptLines: string[];
+  /** Called after the run to collect a log of every request made. */
+  drainLog: () => string[];
+}
+
+interface Request {
+  method: string;
+  /** Path after the base URL, already templated. */
+  path: string;
+  query: Record<string, string>;
+  headers: Record<string, string>;
+  body?: string;
+}
+
+type ToolReply = { content: { type: "text"; text: string }[]; isError: boolean };
+
+/**
+ * The one request path both tool shapes share: rate limit, secrets made
+ * live, base-URL confinement, the API's own headers and query, the timeout,
+ * the truncation, the log line. Typed and generic tools differ only in how
+ * they arrive at a Request.
+ */
+async function performRequest(
+  api: ApiSpec,
+  env: Record<string, string>,
+  bucket: TokenBucket | null,
+  log: string[],
+  req: Request,
+): Promise<ToolReply> {
+  const started = Date.now();
+  try {
+    const waited = bucket ? await bucket.take() : 0;
+    const waitNote = waited >= LOG_WAIT_MS ? ` [waited ${(waited / 1000).toFixed(1)}s for rate limit]` : "";
+    // Per call, not per build: an oauth2 secret's recipe becomes a
+    // live access token here, so a step that runs for an hour keeps
+    // getting fresh tokens (the exchange is cached until near expiry)
+    // — and a recipe can never end up inside a header.
+    const live = await materializeSecrets(env);
+    const path = req.path.startsWith("/") ? req.path : `/${req.path}`;
+    const url = new URL(api.base + path);
+    // Base-URL confinement: a path can't escape the declared host.
+    if (!url.href.startsWith(api.base)) {
+      throw new Error(`path escapes the declared base URL (${api.base})`);
+    }
+    for (const [k, v] of Object.entries(api.query)) {
+      url.searchParams.set(k, substitute(v, live));
+    }
+    for (const [k, v] of Object.entries(req.query)) url.searchParams.set(k, v);
+
+    const headers: Record<string, string> = {};
+    for (const [k, v] of Object.entries(api.headers)) headers[k] = substitute(v, live);
+    for (const [k, v] of Object.entries(req.headers)) headers[k] = v;
+    if (req.body && !headers["content-type"] && !headers["Content-Type"]) {
+      headers["content-type"] = "application/json";
+    }
+
+    // Through the egress proxy when this sandbox was given one: the header
+    // still says ${NAME}, and the worker fills it for this host. Without
+    // one, straight to the API with the value the env held — the CLI, tests,
+    // and an install with no proxy.
+    const res = await fetch(viaEgress(env[EGRESS_ENV], url.href), {
+      method: req.method,
+      headers,
+      body: req.body,
+      // The tool.md's `timeout:` is the only clock; none set, none applied.
+      ...(api.timeout ? { signal: AbortSignal.timeout(api.timeout * 1000) } : {}),
+    });
+    const text = await res.text();
+    const truncated =
+      text.length > MAX_BODY_CHARS
+        ? `${text.slice(0, MAX_BODY_CHARS)}\n…[truncated ${text.length - MAX_BODY_CHARS} chars]`
+        : text;
+
+    log.push(
+      `${req.method} ${url.pathname}${url.search ? "?…" : ""} → ${res.status} (${Date.now() - started}ms)${waitNote}`,
+    );
+    return {
+      content: [{ type: "text" as const, text: `HTTP ${res.status} ${res.statusText}\n\n${truncated}` }],
+      isError: !res.ok,
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    log.push(`${req.method} ${req.path} → error: ${message}`);
+    return { content: [{ type: "text" as const, text: `Request failed: ${message}` }], isError: true };
+  }
+}
+
+const rateSentence = (api: ApiSpec) =>
+  api.rate
+    ? ` Rate limit: ${api.rate.count} call${api.rate.count === 1 ? "" : "s"} per ` +
+      `${api.rate.perSec === api.rate.count ? "second" : `${Math.round(api.rate.count / api.rate.perSec)}s`}, ` +
+      `shared by every call this step makes to ${api.name}; a call over the limit waits its turn.`
+    : "";
+
+/** Zod for one declared parameter, typed as the document says. */
+function paramSchema(p: OperationSpec["params"][number]) {
+  const base =
+    p.type === "integer" ? z.number().int() : p.type === "number" ? z.number() : p.type === "boolean" ? z.boolean() : z.string();
+  const described = base.describe(p.description || `${p.in} parameter ${p.name}`);
+  return p.required ? described : described.optional();
+}
+
+/** Argument keys must be identifiers the model can write; parameter names
+ *  need not be (`filter[status]`). Map one to the other, keeping a
+ *  collision between locations apart with a suffix. */
+function argKeys(op: OperationSpec): Map<string, OperationSpec["params"][number]> {
+  const out = new Map<string, OperationSpec["params"][number]>();
+  for (const p of op.params) {
+    let key = p.name.replace(/[^a-zA-Z0-9_]+/g, "_").replace(/^_+|_+$/g, "") || p.in;
+    if (/^\d/.test(key)) key = `_${key}`;
+    if (out.has(key)) key = `${key}_${p.in}`;
+    let n = 2;
+    while (out.has(key)) key = `${key}_${n++}`;
+    out.set(key, p);
+  }
+  return out;
+}
+
+function typedTool(
+  api: ApiSpec,
+  op: OperationSpec,
+  env: Record<string, string>,
+  bucket: TokenBucket | null,
+  log: string[],
+) {
+  const keys = argKeys(op);
+  const shape: Record<string, z.ZodTypeAny> = {};
+  for (const [key, p] of keys) shape[key] = paramSchema(p);
+  if (op.hasBody) {
+    shape.body = z
+      .string()
+      .optional()
+      .describe(`Request body as a JSON string. ${op.bodyDescription}`.trim());
+  }
+  const description =
+    `${op.summary} — ${op.method} ${op.path} on the ${api.name} API. ` +
+    `Authentication is added automatically — never ask the user for credentials.` +
+    rateSentence(api);
+
+  return tool(typedToolName(api.name, op.id), description, shape, async (args) => {
+    const values = args as Record<string, unknown>;
+    const query: Record<string, string> = {};
+    const headers: Record<string, string> = {};
+    const pathValues: Record<string, string> = {};
+    for (const [key, p] of keys) {
+      const v = values[key];
+      if (v === undefined || v === null) continue;
+      const s = String(v);
+      if (p.in === "path") pathValues[p.name] = s;
+      else if (p.in === "query") query[p.name] = s;
+      else headers[p.name] = s;
+    }
+    let missing: string | null = null;
+    const path = op.path.replace(/\{([^}]+)\}/g, (_, name: string) => {
+      if (!(name in pathValues)) {
+        missing ??= name;
+        return "";
+      }
+      return encodeURIComponent(pathValues[name]);
+    });
+    if (missing) {
+      log.push(`${op.method} ${op.path} → error: path parameter ${missing} not supplied`);
+      return {
+        content: [{ type: "text" as const, text: `Request failed: path parameter "${missing}" is required` }],
+        isError: true,
+      };
+    }
+    return performRequest(api, env, bucket, log, {
+      method: op.method,
+      path,
+      query,
+      headers,
+      body: typeof values.body === "string" ? values.body : undefined,
+    });
+  });
+}
+
+function genericTool(api: ApiSpec, env: Record<string, string>, bucket: TokenBucket | null, log: string[]) {
+  const typed = api.resolvedOperations?.length
+    ? ` Prefer the typed ${api.name}_* tools; this one is the escape hatch for operations they do not cover.`
+    : "";
+  return tool(
+    `call_${api.name}`,
+    `Call the ${api.name} API. ${api.description} Base URL: ${api.base}. ` +
+      `Allowed methods: ${api.methods.join(", ")}. Provide only the path after the base URL. ` +
+      `Authentication is added automatically — never ask the user for credentials.` +
+      typed +
+      rateSentence(api),
+    {
+      method: z.enum(api.methods as [string, ...string[]]).describe("HTTP method"),
+      path: z.string().describe("Path appended to the base URL, e.g. /customers/123/campaigns"),
+      query: z.record(z.string(), z.string()).optional().describe("Query parameters"),
+      body: z.string().optional().describe("Request body — JSON string for JSON APIs"),
+    },
+    (args) =>
+      performRequest(api, env, bucket, log, {
+        method: args.method,
+        path: args.path,
+        query: args.query ?? {},
+        headers: {},
+        body: args.body,
+      }),
+  );
+}
+
+export function buildApiTools(
+  tenant: string,
+  apis: ApiSpec[],
+  workspace?: string,
+  // The runner container passes this: secrets were resolved before the specs
+  // crossed the boundary, and there is no vault in there to ask.
+  resolved?: { env: Record<string, string | undefined>; missing: string[] },
+): ApiToolResult {
+  if (apis.length === 0) {
+    return { server: null, toolNames: [], missingSecrets: [], promptLines: [], drainLog: () => [] };
+  }
+
+  const neededSecrets = [...new Set(apis.flatMap(secretsUsedByApi))];
+  const { env, missing } = resolved
+    ? {
+        env: Object.fromEntries(
+          Object.entries(resolved.env).filter(
+            (entry): entry is [string, string] => typeof entry[1] === "string",
+          ),
+        ),
+        missing: resolved.missing,
+      }
+    : resolveSecrets(tenant, neededSecrets, workspace);
+  const log: string[] = [];
+
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- the SDK types its own list this way
+  const tools: SdkMcpToolDefinition<any>[] = [];
+  const toolNames: string[] = [];
+  const promptLines: string[] = [];
+
+  for (const api of apis) {
+    // One bucket per API per step: the limit is the vendor's, the scope is
+    // this process. Two steps on two workers each get their own.
+    const bucket = api.rate ? new TokenBucket(api.rate.count, api.rate.perSec) : null;
+    const ops = api.resolvedOperations ?? [];
+    // An explicit `operations:` list means "only these": no escape hatch.
+    const withGeneric = !(api.operations && ops.length);
+
+    const typedNames: string[] = [];
+    for (const op of ops) {
+      tools.push(typedTool(api, op, env, bucket, log));
+      typedNames.push(typedToolName(api.name, op.id));
+    }
+    if (withGeneric) tools.push(genericTool(api, env, bucket, log));
+
+    const names = [...typedNames, ...(withGeneric ? [`call_${api.name}`] : [])];
+    toolNames.push(...names.map((n) => `mcp__foldrun_apis__${n}`));
+
+    const rateLine = api.rate ? ` Rate limit ${api.rate.count}/${Math.round(api.rate.count / api.rate.perSec)}s — over it, calls wait.` : "";
+    if (ops.length) {
+      const listed = ops.slice(0, PROMPT_LIST_CAP).map((op) => `  - \`${typedToolName(api.name, op.id)}\` — ${op.summary}`);
+      const more = ops.length > PROMPT_LIST_CAP ? [`  - …and ${ops.length - PROMPT_LIST_CAP} more`] : [];
+      promptLines.push(
+        `- **${api.name}** — ${api.description} Base URL \`${api.base}\`. ` +
+          `${ops.length} typed tool${ops.length === 1 ? "" : "s"}` +
+          (withGeneric ? `, plus \`call_${api.name}\` for anything they do not cover` : "") +
+          `. Credentials are injected for you.${rateLine}`,
+        ...listed,
+        ...more,
+      );
+    } else {
+      promptLines.push(
+        `- **${api.name}** — call with the \`call_${api.name}\` tool. ${api.description} ` +
+          `Base URL \`${api.base}\`; allowed methods ${api.methods.join(", ")}. Credentials are injected for you.${rateLine}`,
+      );
+    }
+  }
+
+  const server = createSdkMcpServer({ name: "foldrun_apis", version: "1.0.0", tools });
+
+  return {
+    server,
+    toolNames,
+    missingSecrets: missing,
+    promptLines,
+    drainLog: () => log.splice(0, log.length),
+  };
+}