@foldrun/core 0.5.0 → 0.7.0

package/dist/src/container.js

@@ -9,6 +9,7 @@
 // Falls back to host execution when Docker isn't available, so local
 // development keeps working with zero configuration.
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { dataRoot } from "./paths.js";
 import { spawnSync, spawn } from "node:child_process";
@@ -135,16 +136,41 @@ export async function runInContainer(opts) {
     }
     const cid = (created.stdout ?? "").trim();
     try {
-        // The agent's own directory becomes /workspace…
-        const copied = docker(["cp", `${opts.agentDir}/.`, `${cid}:/workspace`], 120_000);
-        if (copied.status !== 0) {
-            return { code: null, out: `copy in failed: ${(copied.stderr ?? "").slice(-300)}` };
-        }
+        // The agent's own directory becomes /workspace… — its entries staged
+        // like the workspace paths below (a scratch copy, opened up for the
+        // script's user, one tar), minus the step's `workspace` link. A step
+        // holds that link (→ ../..) so the shell can say workspace/…, and
+        // `docker cp` refuses a link that climbs out of what it copies
+        // ("invalid symlink"), so every Docker-run script failed before it
+        // started. And `docker cp` lands files as root while scripts run as
+        // `agent`, so a script could never write its own outputs/.
+        const own = fs
+            .readdirSync(opts.agentDir)
+            .filter((name) => {
+            if (name !== "workspace")
+                return true;
+            try {
+                return !fs.lstatSync(path.join(opts.agentDir, name)).isSymbolicLink();
+            }
+            catch {
+                return false;
+            }
+        })
+            .map((name) => ({ host: path.join(opts.agentDir, name), container: `/workspace/${name}` }));
+        const copiedIn = stageIn(CLI, cid, own, ["/workspace"]);
+        if (copiedIn)
+            return { code: null, out: `copy in failed: ${copiedIn}` };
         // …and any shared directories land at their declared paths.
         for (const [host, mount] of Object.entries(opts.readOnly ?? {})) {
             if (fs.existsSync(host))
                 docker(["cp", `${host}/.`, `${cid}:${mount}`], 120_000);
         }
+        const staged = opts.staged ?? [];
+        if (staged.length) {
+            const failed = stageIn(CLI, cid, staged);
+            if (failed)
+                return { code: null, out: `copy in failed: ${failed}` };
+        }
         const result = await new Promise((resolve) => {
             const child = spawn(CLI, ["start", "-a", cid], { timeout: opts.timeoutMs });
             let out = "";
@@ -164,9 +190,93 @@ export async function runInContainer(opts) {
         });
         // Bring deliverables back so outputs/ behaves the same either way.
         docker(["cp", `${cid}:/workspace/outputs/.`, path.join(opts.agentDir, "outputs")], 120_000);
+        for (const s of staged)
+            stageBack(CLI, cid, s);
         return result;
     }
     finally {
         docker(["rm", "-f", cid], 30_000);
     }
 }
+/**
+ * Copy the staged workspace paths into a created container: one tar, built
+ * in a scratch directory that mirrors the container paths, extracted at /.
+ * A path that does not exist yet (an output the script is told to write)
+ * gets its parent directory, so the write has somewhere to land.
+ */
+function stageIn(cli, cid, staged, dirs = []) {
+    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-stage-"));
+    try {
+        for (const d of dirs)
+            fs.mkdirSync(path.join(scratch, d), { recursive: true });
+        for (const { host, container } of staged) {
+            const dest = path.join(scratch, container);
+            if (fs.existsSync(host)) {
+                fs.mkdirSync(path.dirname(dest), { recursive: true });
+                fs.cpSync(host, dest, { recursive: true, dereference: false });
+            }
+            else {
+                fs.mkdirSync(path.dirname(dest), { recursive: true });
+            }
+        }
+        // `docker cp` lands files as root and scripts run as `agent`: these are
+        // scratch copies, so open them up for the script to write into.
+        openUp(scratch);
+        const top = fs.readdirSync(scratch);
+        const r = spawnSync("sh", ["-c", 'dir="$1"; cli="$2"; dest="$3"; shift 3; tar --no-xattrs -C "$dir" -cf - -- "$@" | "$cli" cp - "$dest"', "sh", scratch, cli, `${cid}:/`, ...top], { encoding: "utf8", timeout: 120_000, env: { ...process.env, COPYFILE_DISABLE: "1" } });
+        return r.status === 0 ? null : (r.stderr ?? "").slice(-300);
+    }
+    finally {
+        fs.rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/**
+ * Copy back what the script created or changed under one staged path. Files
+ * whose bytes did not change are left alone, so an input keeps its mtime —
+ * freshness checks read it.
+ */
+function stageBack(cli, cid, s) {
+    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-stage-"));
+    try {
+        const out = path.join(scratch, "x");
+        const got = spawnSync(cli, ["cp", `${cid}:${s.container}`, out], { encoding: "utf8", timeout: 120_000 });
+        if (got.status !== 0 || !fs.existsSync(out))
+            return;
+        syncChanged(out, s.host);
+    }
+    finally {
+        fs.rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/** Write `from` over `to` where the bytes differ; recurse into folders. */
+export function syncChanged(from, to) {
+    const st = fs.lstatSync(from);
+    if (st.isSymbolicLink())
+        return;
+    if (st.isDirectory()) {
+        fs.mkdirSync(to, { recursive: true });
+        for (const name of fs.readdirSync(from))
+            syncChanged(path.join(from, name), path.join(to, name));
+        return;
+    }
+    const next = fs.readFileSync(from);
+    if (fs.existsSync(to) && fs.statSync(to).isFile() && fs.readFileSync(to).equals(next))
+        return;
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.writeFileSync(to, next);
+}
+/** Directories 0777, files writable by all (exec bits kept): a scratch tree only. */
+function openUp(dir) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        const p = path.join(dir, entry.name);
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory()) {
+            fs.chmodSync(p, 0o777);
+            openUp(p);
+        }
+        else {
+            fs.chmodSync(p, fs.statSync(p).mode | 0o666);
+        }
+    }
+}

package/dist/src/context-tools.d.ts

@@ -1,7 +1,7 @@
 import { createSdkMcpServer } from "@anthropic-ai/claude-agent-sdk";
 import type { RunRecord } from "./store.ts";
 export interface SearchRoot {
-    /** How the agent should name the place: "knowledge/", "../../memory/". */
+    /** How the agent should name the place: "knowledge/", "workspace/memory/". */
     label: string;
     /** The directory, absolute. */
     dir: string;

package/dist/src/deploy.d.ts

@@ -60,6 +60,15 @@ export declare function readTree(dir: string): DeployFile[];
  *  only the deployed files, so a library or gallery outward tool is not seen
  *  here — `foldrun check`, which resolves every scope, remains the real gate.
  *  Non-blocking by decision: the deploy proceeds and says so. */
+/**
+ * A frontmatter block that lost its opening `---`: `key: value` lines, then a
+ * lone `---`, with nothing above them. Nothing is read from it — the parser
+ * sees prose — so the agent runs with no tools and the default model, and a
+ * model told to call a tool it was never given writes the call out as text.
+ * seo-digest's editor did that every Sunday from 20 Sep to 5 Oct 2026.
+ * Returns the problem, or null.
+ */
+export declare function unopenedFrontmatter(raw: string): string | null;
 export declare function deployWarnings(files: DeployFile[]): DeployIssue[];
 export declare function deployIssues(files: DeployFile[]): DeployIssue[];
 /**

package/dist/src/deploy.js

@@ -164,6 +164,27 @@ export function readTree(dir) {
  *  only the deployed files, so a library or gallery outward tool is not seen
  *  here — `foldrun check`, which resolves every scope, remains the real gate.
  *  Non-blocking by decision: the deploy proceeds and says so. */
+/**
+ * A frontmatter block that lost its opening `---`: `key: value` lines, then a
+ * lone `---`, with nothing above them. Nothing is read from it — the parser
+ * sees prose — so the agent runs with no tools and the default model, and a
+ * model told to call a tool it was never given writes the call out as text.
+ * seo-digest's editor did that every Sunday from 20 Sep to 5 Oct 2026.
+ * Returns the problem, or null.
+ */
+export function unopenedFrontmatter(raw) {
+    const text = raw.replace(/^\uFEFF/, "");
+    if (/^---\r?\n/.test(text))
+        return null;
+    const lines = text.split(/\r?\n/);
+    const close = lines.findIndex((l) => l.trim() === "---");
+    if (close < 1)
+        return null;
+    const above = lines.slice(0, close).filter((l) => l.trim() && !l.trim().startsWith("#"));
+    if (!above.length || !above.every((l) => /^[A-Za-z_][\w-]*:(\s|$)/.test(l) || /^\s+\S/.test(l)))
+        return null;
+    return "the frontmatter has no opening `---`, so none of it is read: the agent runs with no tools and the default model. Add `---` as the first line.";
+}
 export function deployWarnings(files) {
     const front = (content) => {
         try {
@@ -190,6 +211,9 @@ export function deployWarnings(files) {
     const outwardAgents = [];
     const agentNames = [];
     const out = [];
+    if (!files.some((f) => /^agents\/[^/]+\/agent\.md$/.test(f.path)) && !files.some((f) => /^\.(claude|agents)\/agents\/[^/]+\.md$/.test(f.path))) {
+        out.push({ where: "agents/", message: "no agents yet — add one (agents/<name>/agent.md), or import one from another workspace" });
+    }
     // The web: warnings check prints — the old session: key, and a pinned
     // user agent behind the runner image's Chrome, which the platform knows
     // from FOLDRUN_RUNNER_ENGINES (the deploy read it from the image).
@@ -257,6 +281,9 @@ export function deployIssues(files) {
     for (const f of files) {
         if (!/^(AGENTS\.md|agents\/[^/]+\/agent\.md)$/.test(f.path))
             continue;
+        const unopened = unopenedFrontmatter(f.content);
+        if (unopened)
+            at(f.path, unopened);
         let front = {};
         try {
             front = matter(f.content).data;
@@ -285,9 +312,10 @@ export function deployIssues(files) {
         for (const w of localeProblems(front))
             at(f.path, w);
     }
-    if (agents.size === 0) {
-        at("agents/", "no agents — a workspace needs at least one agents/<name>/agent.md");
-    }
+    // No agents is a workspace that has not started yet — "Create workspace"
+    // makes exactly that — and deploying it is harmless: a flow that names an
+    // agent this push lacks is refused below, step by step. deployWarnings says
+    // it, so the empty state is visible without blocking the first push.
     // Flows, parsed from the incoming text rather than from disk. A step naming
     // an agent that this push does not ship is the single most common way a
     // deploy breaks a schedule, and it is free to catch here.

package/dist/src/evals.js

@@ -30,6 +30,8 @@
 // Deterministic checks run first and cost nothing. The judge only runs if
 // they pass — no point paying a model to grade output already known to be
 // wrong.
+import { accountModelEnv } from "./model-env.js";
+import { sdkEnv } from "./step-exec.js";
 import fs from "node:fs";
 import path from "node:path";
 import { deployedCommit } from "./deploy.js";
@@ -352,7 +354,7 @@ function shell(command, cwd) {
 // The judge gets the rubric and the output, and must answer with one word.
 // Constrained output beats asking for a score: "PASS" or "FAIL" can't be
 // misread, where "7/10" needs a threshold nobody agreed on.
-async function judge(rubric, output, model, effort) {
+async function judge(rubric, output, model, effort, env) {
     const prompt = `You are grading one piece of output against one criterion. Answer with exactly ` +
         `PASS or FAIL on the first line, then one short sentence of reason.\n\n` +
         `Criterion: ${rubric}\n\n<output>\n${output.slice(0, 20000)}\n</output>`;
@@ -365,6 +367,8 @@ async function judge(rubric, output, model, effort) {
             tools: [],
             allowedTools: [],
             settingSources: [],
+            strictMcpConfig: true,
+            env,
             maxTurns: 1,
         },
     });
@@ -378,7 +382,7 @@ async function judge(rubric, output, model, effort) {
     }
     return text.trim();
 }
-async function checkAssertion(assertion, output, agentDir, model, effort) {
+async function checkAssertion(assertion, output, agentDir, model, effort, judgeEnv = () => sdkEnv(undefined)) {
     const hay = output.toLowerCase();
     switch (assertion.type) {
         case "contains": {
@@ -411,7 +415,16 @@ async function checkAssertion(assertion, output, agentDir, model, effort) {
             return { assertion, passed: code === 0, detail: `exit ${code ?? "error"}${out ? ` — ${out.slice(0, 200)}` : ""}` };
         }
         case "judge": {
-            const verdict = await judge(assertion.value, output, model, effort);
+            // The judge runs on the account's own model key, never quietly on the
+            // platform's: a customer's eval is not the operator's bill.
+            let env;
+            try {
+                env = judgeEnv();
+            }
+            catch (err) {
+                return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
+            }
+            const verdict = await judge(assertion.value, output, model, effort, env);
             const passed = /^\s*PASS\b/i.test(verdict);
             return { assertion, passed, detail: verdict.slice(0, 300) || "judge returned nothing" };
         }
@@ -482,8 +495,15 @@ export async function runEval(tenant, workspace, info) {
             for (const a of cheap)
                 assertions.push(await checkAssertion(a, output, agentDir, info.model, info.effort));
             if (assertions.every((r) => r.passed)) {
+                const judgeEnv = () => {
+                    const m = accountModelEnv(tenant, workspace, () => sdkEnv(undefined));
+                    if (m.format !== "anthropic") {
+                        throw new Error(`this account's provider speaks ${m.format}; a judge needs an Anthropic-format provider`);
+                    }
+                    return m.env;
+                };
                 for (const a of judges)
-                    assertions.push(await checkAssertion(a, output, agentDir, info.model, info.effort));
+                    assertions.push(await checkAssertion(a, output, agentDir, info.model, info.effort, judgeEnv));
             }
             else {
                 for (const a of judges) {

package/dist/src/host-env.d.ts

@@ -6,3 +6,17 @@ export declare function hostEnvAllowed(name: string): boolean;
  * caller that layers secrets on top never writes into the host's own env.
  */
 export declare function hostSafeEnv(from?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * Where this install's own API answers, for a step to call: `FOLDRUN_API_URL`
+ * when the operator set it, else `FOLDRUN_PUBLIC_URL` + `/api`. Undefined on a
+ * laptop with neither.
+ *
+ * A desk that reads its own run history used to write the host into its
+ * files (`https://dev.foldrun.io/api`), so the same workspace pointed at the
+ * wrong server the day it moved. Now a script reads `$FOLDRUN_API_URL` and an
+ * `apis:` entry writes `base: ${FOLDRUN_API_URL}`.
+ */
+export declare function platformApiUrl(from?: NodeJS.ProcessEnv): string | undefined;
+/** The install's own addresses an `apis:` base may name. Not secrets: they
+ *  are printed in the prompt as the tool's base URL. */
+export declare function expandPlatformVars(value: string, from?: NodeJS.ProcessEnv): string;

package/dist/src/host-env.js

@@ -19,6 +19,11 @@
 const EXACT = new Set([
     "PATH", "HOME", "TMPDIR", "TMP", "TEMP", "LANG", "LANGUAGE",
     "TZ", "TERM", "SHELL", "USER", "LOGNAME",
+    // Where Claude Code / the Agent SDK keeps its config and session
+    // transcripts — the same kind of thing as HOME (a path, not a secret), and
+    // without it an operator cannot keep them out of the host user's
+    // ~/.claude: the box's deploy tests set it to the job's temp (2026-10-02).
+    "CLAUDE_CONFIG_DIR",
     // The host's way to the network is the child's way to the network.
     "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "no_proxy",
     "SSL_CERT_FILE", "SSL_CERT_DIR",
@@ -46,3 +51,29 @@ export function hostSafeEnv(from = process.env) {
     // every spawn. The value is the same either way.
     return out;
 }
+/**
+ * Where this install's own API answers, for a step to call: `FOLDRUN_API_URL`
+ * when the operator set it, else `FOLDRUN_PUBLIC_URL` + `/api`. Undefined on a
+ * laptop with neither.
+ *
+ * A desk that reads its own run history used to write the host into its
+ * files (`https://dev.foldrun.io/api`), so the same workspace pointed at the
+ * wrong server the day it moved. Now a script reads `$FOLDRUN_API_URL` and an
+ * `apis:` entry writes `base: ${FOLDRUN_API_URL}`.
+ */
+export function platformApiUrl(from = process.env) {
+    const explicit = from.FOLDRUN_API_URL?.trim();
+    if (explicit)
+        return explicit.replace(/\/+$/, "");
+    const origin = from.FOLDRUN_PUBLIC_URL?.trim();
+    return origin ? `${origin.replace(/\/+$/, "")}/api` : undefined;
+}
+/** The install's own addresses an `apis:` base may name. Not secrets: they
+ *  are printed in the prompt as the tool's base URL. */
+export function expandPlatformVars(value, from = process.env) {
+    const vars = {
+        FOLDRUN_API_URL: platformApiUrl(from),
+        FOLDRUN_PUBLIC_URL: from.FOLDRUN_PUBLIC_URL?.trim().replace(/\/+$/, "") || undefined,
+    };
+    return value.replace(/\$\{(FOLDRUN_API_URL|FOLDRUN_PUBLIC_URL)\}/g, (whole, name) => vars[name] ?? whole);
+}

package/dist/src/install-helper.d.ts

@@ -0,0 +1,17 @@
+import net from "node:net";
+export interface InstallRequest {
+    manager: "apt";
+    packages: string[];
+}
+export interface InstallReply {
+    ok: boolean;
+    /** "snapshot" | "apt" */
+    mode?: string;
+    seconds?: number;
+    error?: string;
+}
+/** Validate one request; null when it may run. Exported for the tests. */
+export declare function refuse(req: unknown): string | null;
+/** Install one validated request with the start-up's own snippet. */
+export declare function installApt(packages: string[], cacheDir: string): Promise<InstallReply>;
+export declare function serve(socket: string, cacheDir: string): net.Server;

package/dist/src/install-helper.js

@@ -0,0 +1,134 @@
+// The root half of the `install` tool: a tiny server the run container's root
+// start-up leaves running before it drops to the agent user.
+//
+//   node install-helper.js <socket> <runtime cache dir>
+//
+// The agent never becomes root. It can only ask this process, over a unix
+// socket, to install Debian packages BY NAME — each name re-checked against
+// Debian's naming rule here, so nothing but a package name reaches apt, and
+// apt is driven by the same snippet the start-up uses (systemInstallSh): the
+// account's .deb cache and snapshots, so a package anyone installed before is
+// restored in about a second. Requests are served one at a time; the process
+// dies with the container.
+//
+// pip and npm need no root and are installed by the tool itself, as the agent.
+import fs from "node:fs";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { DEB_PACKAGE, systemInstallSh, summarizeInstallFailure } from "./runtime.js";
+/** Validate one request; null when it may run. Exported for the tests. */
+export function refuse(req) {
+    const r = req;
+    if (!r || typeof r !== "object")
+        return "not a request";
+    if (r.manager !== "apt")
+        return "this helper installs Debian packages (manager: apt) only";
+    if (!Array.isArray(r.packages) || r.packages.length === 0)
+        return "no packages named";
+    if (r.packages.length > 50)
+        return "at most 50 packages per request";
+    const bad = r.packages.filter((p) => typeof p !== "string" || !DEB_PACKAGE.test(p));
+    if (bad.length)
+        return `not Debian package names: ${bad.map(String).join(", ")}`;
+    return null;
+}
+/** Install one validated request with the start-up's own snippet. */
+export function installApt(packages, cacheDir) {
+    const logDir = fs.mkdtempSync(path.join(os.tmpdir(), "foldrun-install-"));
+    return new Promise((resolve) => {
+        const child = spawn("sh", ["-c", systemInstallSh(cacheDir, logDir)], {
+            env: { ...process.env, FOLDRUN_SYSTEM_PACKAGES: packages.join(" ") },
+            stdio: "ignore",
+        });
+        child.on("close", () => {
+            let status = {};
+            try {
+                status = JSON.parse(fs.readFileSync(path.join(logDir, "system-install.json"), "utf8"));
+            }
+            catch {
+                status = { ok: false };
+            }
+            let log = "";
+            try {
+                log = fs.readFileSync(path.join(logDir, "system-install.log"), "utf8");
+            }
+            catch {
+                log = "";
+            }
+            fs.rmSync(logDir, { recursive: true, force: true });
+            resolve(status.ok
+                ? { ok: true, mode: status.mode, seconds: status.seconds }
+                : { ok: false, error: summarizeInstallFailure("apt-get install", log || "no output") });
+        });
+        child.on("error", (err) => {
+            fs.rmSync(logDir, { recursive: true, force: true });
+            resolve({ ok: false, error: `could not run the installer: ${err.message}` });
+        });
+    });
+}
+export function serve(socket, cacheDir) {
+    try {
+        fs.rmSync(socket, { force: true });
+    }
+    catch {
+        /* nothing there */
+    }
+    let queue = Promise.resolve();
+    const server = net.createServer((conn) => {
+        let buf = "";
+        conn.on("data", (chunk) => {
+            buf += chunk.toString("utf8");
+            if (buf.length > 64_000) {
+                conn.end(JSON.stringify({ ok: false, error: "request too large" }) + "\n");
+                return;
+            }
+            const nl = buf.indexOf("\n");
+            if (nl < 0)
+                return;
+            const line = buf.slice(0, nl);
+            buf = "";
+            let req;
+            try {
+                req = JSON.parse(line);
+            }
+            catch {
+                conn.end(JSON.stringify({ ok: false, error: "not JSON" }) + "\n");
+                return;
+            }
+            const why = refuse(req);
+            if (why) {
+                conn.end(JSON.stringify({ ok: false, error: why }) + "\n");
+                return;
+            }
+            // One install at a time: apt holds a lock, and two dpkg runs in one
+            // container would fight over it.
+            queue = queue.then(async () => {
+                const reply = await installApt(req.packages, cacheDir);
+                conn.end(JSON.stringify(reply) + "\n");
+            });
+        });
+        conn.on("error", () => {
+            /* the client went away */
+        });
+    });
+    server.listen(socket, () => {
+        // The agent user must be able to connect; nothing else runs in here.
+        try {
+            fs.chmodSync(socket, 0o666);
+        }
+        catch {
+            /* best effort */
+        }
+    });
+    return server;
+}
+if (process.argv[1] && /install-helper\.(js|ts|mjs)$/.test(process.argv[1])) {
+    const [socket, cacheDir] = process.argv.slice(2);
+    if (!socket || !cacheDir) {
+        console.error("usage: install-helper <socket> <runtime cache dir>");
+        process.exit(2);
+    }
+    serve(socket, cacheDir);
+}

package/dist/src/install-tool.d.ts

@@ -0,0 +1,128 @@
+type Emit = (type: "text" | "tool" | "info" | "error", text: string) => void;
+export declare const INSTALL_TOOL = "mcp__foldrun_install__install";
+/** Ask the root helper; resolves with its reply or an error. */
+export declare function askHelper(socket: string, packages: string[], timeoutMs?: number): Promise<{
+    ok: boolean;
+    mode?: string;
+    seconds?: number;
+    error?: string;
+}>;
+export declare function buildInstallTool(opts: {
+    /** The per-step directory pip and npm install into (stepInstallEnv's). */
+    dir: string;
+    /** The root helper's socket; null where there is none (a laptop). */
+    socket: string | null;
+    /** The account's runtime cache, for uv's and npm's download caches. */
+    cacheRoot: string;
+    /** The interpreter pip installs for: the declared venv's, else python3. */
+    python: string;
+    env: Record<string, string | undefined>;
+    emit: Emit;
+}): {
+    server: import("@anthropic-ai/claude-agent-sdk").McpSdkServerConfigWithInstance;
+    toolName: string;
+    /** What this step installed, `manager:name`, for the run record. */
+    installed: () => string[];
+    /** The handler, for tests. */
+    call: (args: {
+        manager: "apt" | "pip" | "npm";
+        packages: string[];
+    }) => Promise<{
+        [x: string]: unknown;
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+        content: ({
+            type: "text";
+            text: string;
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            type: "image";
+            data: string;
+            mimeType: string;
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            type: "audio";
+            data: string;
+            mimeType: string;
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        } | {
+            uri: string;
+            description?: string | undefined;
+            mimeType?: string | undefined;
+            size?: number | undefined;
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+            icons?: {
+                src: string;
+                mimeType?: string | undefined;
+                sizes?: string[] | undefined;
+                theme?: "dark" | "light" | undefined;
+            }[] | undefined;
+            name: string;
+            title?: string | undefined;
+            type: "resource_link";
+        } | {
+            type: "resource";
+            resource: {
+                uri: string;
+                mimeType?: string | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+                text: string;
+            } | {
+                uri: string;
+                mimeType?: string | undefined;
+                _meta?: {
+                    [x: string]: unknown;
+                } | undefined;
+                blob: string;
+            };
+            annotations?: {
+                audience?: ("assistant" | "user")[] | undefined;
+                priority?: number | undefined;
+                lastModified?: string | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+        })[];
+        structuredContent?: {
+            [x: string]: unknown;
+        } | undefined;
+        isError?: boolean | undefined;
+    }>;
+};
+export {};