@geohar/pi-mcp-combiner 0.14.3 → 0.16.0-dev.2

package/src/client/connection.ts

@@ -1,373 +0,0 @@
-// The combiner MCP client: one streamable-HTTP connection, one token, reconnect.
-//
-// This is the piece that makes the extension the adapter: it owns the Client +
-// StreamableHTTPClientTransport pair against the combiner's /mcp endpoint, mints the
-// per-Pi-session grouping token into the URL path (URL form beats headers combiner-
-// side, so the token rides the path), sends the optional inbound bearer, bridges
-// elicitation to Pi's UI, and keeps a tools/list cache fresh via tools/list_changed.
-//
-// Lifecycle: lazy by default (connect on first mcp() call), `eager` connects at
-// session_start. A session reset (new/resume/fork/reload) rebinds the token and
-// drops the client; a transport close or stale-session 404 triggers a one-shot
-// reconnect-and-retry on the next call. The combiner's handover means the same token
-// resumes its parked isolated upstream sessions after a combiner restart.
-
-import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client"
-import type { ElicitResult } from "@modelcontextprotocol/client"
-import { handleElicitation, type ElicitUi } from "./elicitation.js"
-import type { ServerFilter } from "./config-ladder.js"
-
-export type LogFn = (level: "info" | "warn" | "error", message: string) => void
-
-export type ResolvedConnection = {
-    /** Base URL including /mcp, WITHOUT any token path (e.g. http://127.0.0.1:9741/mcp). */
-    baseUrl: string
-    /** Env var holding the inbound bearer token (read at connect time), if any. */
-    bearerTokenEnv?: string
-    /** Explicit token already present in the configured URL path (user override). */
-    urlToken?: string
-}
-
-export type ConnectionState = "disconnected" | "connecting" | "connected" | "failed"
-
-export type ToolSummary = { name: string; description?: string; inputSchema?: unknown }
-
-export type PromptArgument = { name: string; description?: string; required?: boolean }
-
-export type PromptSummary = { name: string; title?: string; description?: string; arguments?: PromptArgument[] }
-
-export type ResourceSummary = {
-    uri: string
-    name?: string
-    description?: string
-    mimeType?: string
-    _meta?: Record<string, unknown>
-}
-
-/** Optional callbacks fired by the connection (set from index.ts wiring). */
-export type ConnectionHooks = {
-    /** tools/list_changed arrived — caches invalidated; refresh derived surfaces. */
-    onToolsChanged?: () => void
-    /** connection state transitioned — refresh footer/status surfaces. */
-    onStateChange?: (state: ConnectionState) => void
-    /** Stage 2: the combiner announced a widget UI URL while an agent tool call
-     *  is held in flight — the client should open it (gated by uiAutoOpen). */
-    onWidgetUrl?: (url: string) => void
-}
-
-const CLIENT_INFO = { name: "pi-mcp-combiner", version: "0.1.0" }
-const CONNECT_TIMEOUT_MS = 8_000
-
-function isRecord(v: unknown): v is Record<string, unknown> {
-    return typeof v === "object" && v !== null && !Array.isArray(v)
-}
-
-/** Pull {message, requestedSchema} out of an elicitation/create request params,
- *  tolerating both form-mode and legacy shapes. Returns undefined when unusable. */
-function toElicitParams(raw: unknown): { message?: string; requestedSchema?: unknown } | undefined {
-    const p = isRecord(raw) ? raw : undefined
-    if (!p) return undefined
-    const out: { message?: string; requestedSchema?: unknown } = {}
-    if (typeof p.message === "string") out.message = p.message
-    if (isRecord(p.requestedSchema)) out.requestedSchema = p.requestedSchema
-    return out
-}
-
-/** Build the tokened endpoint URL: <origin>/mcp/<token> (combiner's URL form). */
-export function tokenedUrl(baseUrl: string, token: string): string {
-    try {
-        const u = new URL(baseUrl)
-        // Normalize to bare /mcp (strip any existing path segments below it), append token.
-        const path = u.pathname.replace(/\/mcp(?:\/[^/]*)*\/?$/, "/mcp")
-        u.pathname = `${path.replace(/\/$/, "")}/${encodeURIComponent(token)}`
-        return u.toString()
-    } catch {
-        return baseUrl
-    }
-}
-
-export class CombinerConnection {
-    private conn: ResolvedConnection
-    private readonly log: LogFn
-    /** Latest dialog-capable UI, refreshed each session_start. */
-    private elicitUi: ElicitUi = { hasUI: false }
-    private prompts: PromptSummary[] | undefined
-    private promptsFetchedAt = 0
-    private resources: ResourceSummary[] | undefined
-    private resourcesFetchedAt = 0
-    private token: string | undefined
-    private client: Client | undefined
-    private connecting: Promise<Client> | undefined
-    private tools: ToolSummary[] | undefined
-    private toolsFetchedAt = 0
-    private hooks: ConnectionHooks = {}
-    state: ConnectionState = "disconnected"
-    lastError: string | undefined
-
-    constructor(conn: ResolvedConnection, log: LogFn) {
-        this.conn = conn
-        this.log = log
-    }
-
-    /** Bind lifecycle hooks (tools changed / state transitions). */
-    setHooks(hooks: ConnectionHooks): void {
-        this.hooks = hooks
-    }
-
-    /** Effective grouping token for this session (explicit URL token wins). */
-    get sessionToken(): string | undefined {
-        return this.effectiveToken()
-    }
-
-    /** Bind the UI slice used by elicitation (called from session_start). */
-    bindUi(ui: ElicitUi): void {
-        this.elicitUi = ui
-    }
-
-    /** Swap connection inputs (base URL / bearer env) when a session re-resolves a
-     *  different combiner URL (e.g. a worktree branch pinning its own combiner).
-     *  No-op when nothing changed; otherwise drops the client for a fresh connect. */
-    rebind(conn: ResolvedConnection): boolean {
-        if (
-            conn.baseUrl === this.conn.baseUrl &&
-            conn.bearerTokenEnv === this.conn.bearerTokenEnv &&
-            conn.urlToken === this.conn.urlToken
-        ) {
-            return false
-        }
-        this.conn = conn
-        void this.reset("connection rebound (session config changed)")
-        return true
-    }
-
-    /** Set the grouping token for this session; resets any open connection. */
-    setToken(token: string): void {
-        if (this.token === token) return
-        this.token = token
-        void this.reset("token changed")
-    }
-
-    /** Drop the connection + caches (session reset / shutdown). Never throws. */
-    async reset(reason: string): Promise<void> {
-        const client = this.client
-        this.client = undefined
-        this.connecting = undefined
-        this.tools = undefined
-        this.state = "disconnected"
-        try {
-            await client?.close()
-        } catch {
-            // best-effort
-        }
-        if (reason) this.log("info", `connection reset (${reason})`)
-    }
-
-    /** Effective token: explicit URL token wins over the minted session token. */
-    private effectiveToken(): string | undefined {
-        return this.conn.urlToken ?? this.token
-    }
-
-    /** Connect (idempotent, single-flight). Throws with a human message on failure. */
-    async ensureConnected(): Promise<Client> {
-        if (this.client) return this.client
-        if (this.connecting) return this.connecting
-
-        const token = this.effectiveToken()
-        if (!token) throw new Error("no grouping token set (session not started)")
-        const url = tokenedUrl(this.conn.baseUrl, token)
-        let endpoint: URL
-        try {
-            endpoint = new URL(url)
-        } catch {
-            throw new Error(`combiner URL "${url}" is not parseable; set a valid url (…/mcp) in settings or mcp.json`)
-        }
-        const bearer = this.conn.bearerTokenEnv ? process.env[this.conn.bearerTokenEnv] : undefined
-
-        this.state = "connecting"
-        this.connecting = (async () => {
-            const client = new Client(CLIENT_INFO, { capabilities: { elicitation: {} } })
-            const transport = new StreamableHTTPClientTransport(endpoint, {
-                authProvider: bearer ? { token: async () => bearer } : undefined,
-            })
-            // Elicitation bridge — the combiner's permission gate depends on it.
-            client.setRequestHandler("elicitation/create", (req): ElicitResult | Promise<ElicitResult> => {
-                const params = toElicitParams(isRecord(req) ? req.params : undefined)
-                if (!params) return { action: "decline" }
-                return handleElicitation(params, this.elicitUi)
-            })
-            client.setNotificationHandler("notifications/tools/list_changed", () => {
-                this.tools = undefined // refetch on next list
-                this.prompts = undefined
-                this.resources = undefined
-                try {
-                    this.hooks.onToolsChanged?.()
-                } catch {
-                    // hook errors must never break the notification path
-                }
-            })
-            client.setNotificationHandler("notifications/resources/list_changed", () => {
-                this.resources = undefined
-                try {
-                    this.hooks.onToolsChanged?.()
-                } catch {
-                    // hook errors must never break the notification path
-                }
-            })
-            // Stage 2: the widget hold announces its UI URL via a log
-            // notification ("Interactive UI ready: <url>") while the agent's
-            // call is in flight — open it so the user sees the widget at once.
-            client.setNotificationHandler("notifications/message", (n) => {
-                const data = (n.params as { data?: unknown } | undefined)?.data
-                if (typeof data !== "string") return
-                const m = data.match(/Interactive UI ready: (\S+)/)
-                if (m) {
-                    try {
-                        this.hooks.onWidgetUrl?.(m[1])
-                    } catch {
-                        // hook errors must never break the notification path
-                    }
-                }
-            })
-            client.onclose = () => {
-                if (this.client === client) {
-                    this.client = undefined
-                    this.state = "disconnected"
-                }
-            }
-
-            await Promise.race([
-                client.connect(transport),
-                new Promise((_, reject) => setTimeout(() => reject(new Error("connect timeout")), CONNECT_TIMEOUT_MS)),
-            ])
-
-            this.client = client
-            this.state = "connected"
-            this.lastError = undefined
-            this.hooks.onStateChange?.(this.state)
-            return client
-        })()
-
-        try {
-            return await this.connecting
-        } catch (e) {
-            this.state = "failed"
-            this.lastError = e instanceof Error ? e.message : String(e)
-            this.log("warn", `combiner connect failed (${this.lastError})`)
-            this.hooks.onStateChange?.(this.state)
-            throw new Error(`cannot reach the combiner at ${this.conn.baseUrl}: ${this.lastError}`)
-        } finally {
-            this.connecting = undefined
-        }
-    }
-
-    /** tools/list, cached until invalidated (list_changed / reset / reconnect). */
-    async listTools(force = false): Promise<ToolSummary[]> {
-        if (!force && this.tools && Date.now() - this.toolsFetchedAt < 5_000) return this.tools
-        const client = await this.ensureConnected()
-        const res = await client.listTools()
-        this.tools = (res.tools ?? []) as ToolSummary[]
-        this.toolsFetchedAt = Date.now()
-        return this.tools
-    }
-
-    /** prompts/list, cached alongside tools (combiner namespaces `<server>_<name>`). */
-    async listPrompts(force = false): Promise<PromptSummary[]> {
-        if (!force && this.prompts && Date.now() - this.promptsFetchedAt < 5_000) return this.prompts
-        const client = await this.ensureConnected()
-        const res = await client.listPrompts()
-        this.prompts = (res.prompts ?? []) as PromptSummary[]
-        this.promptsFetchedAt = Date.now()
-        return this.prompts
-    }
-
-    /** prompts/get through the combiner. */
-    async getPrompt(name: string, args: Record<string, string>): Promise<unknown> {
-        const client = await this.ensureConnected()
-        return client.getPrompt({ name, arguments: args })
-    }
-
-    /** resources/list, cached alongside tools/prompts. */
-    async listResources(force = false): Promise<ResourceSummary[]> {
-        if (!force && this.resources && Date.now() - this.resourcesFetchedAt < 5_000) return this.resources
-        const client = await this.ensureConnected()
-        const res = await client.listResources()
-        this.resources = (res.resources ?? []) as ResourceSummary[]
-        this.resourcesFetchedAt = Date.now()
-        return this.resources
-    }
-
-    /** resources/read through the combiner. */
-    async readResource(uri: string): Promise<unknown> {
-        const client = await this.ensureConnected()
-        return client.readResource({ uri })
-    }
-
-    /** callTool with a single stale-session retry: on transport/stale errors we reset
-     *  and reconnect once (the combiner may have bounced; handover keeps our token). */
-    async callTool(name: string, args: Record<string, unknown> | undefined): Promise<unknown> {
-        const attempt = async (): Promise<unknown> => {
-            const client = await this.ensureConnected()
-            return client.callTool({ name, arguments: args ?? {} })
-        }
-        try {
-            return await attempt()
-        } catch (e) {
-            const msg = e instanceof Error ? e.message : String(e)
-            const stale = /404|stale|session|not found|closed|fetch failed/i.test(msg)
-            if (!stale) throw e
-            this.log("info", `call "${name}" went stale (${msg}); reconnecting once`)
-            await this.reset("stale session")
-            return await attempt()
-        }
-    }
-
-    /** Control-plane origin for the combiner's REST routes (/health, /sessions/*). */
-    controlOrigin(): string {
-        try {
-            return new URL(this.conn.baseUrl).origin
-        } catch {
-            return this.conn.baseUrl
-        }
-    }
-
-    /** The interactive-UI URL for a resource (the combiner's UI host serves the
-     *  widget for THIS session's token), or empty when no token is set. */
-    uiUrlFor(resourceUri: string): string {
-        const token = this.effectiveToken()
-        if (!token || !resourceUri) return ""
-        return `${this.controlOrigin()}/ui/${encodeURIComponent(token)}/?resource=${encodeURIComponent(resourceUri)}`
-    }
-
-    /** Headers for control-plane calls: the same inbound bearer as /mcp (the combiner
-     *  gates its mutating routes — /sessions*, /handover* — with it; /health is open
-     *  but presenting anyway is harmless). */
-    private controlHeaders(): Record<string, string> {
-        const token = this.conn.bearerTokenEnv ? process.env[this.conn.bearerTokenEnv] : undefined
-        return token ? { authorization: `Bearer ${token}` } : {}
-    }
-
-    /** POST the project-derived server filter for our token. The combiner accepts
-     *  pending filters pre-connect, so this is safe before the first connect. */
-    async applyFilter(filter: ServerFilter): Promise<void> {
-        const token = this.effectiveToken()
-        if (!token) throw new Error("no grouping token set (session not started)")
-        const body: Record<string, unknown> = {}
-        if (filter.allow?.length) body.allowed_servers = filter.allow
-        else if (filter.deny?.length) body.disabled_servers = filter.deny
-        else return
-        const res = await fetch(`${this.controlOrigin()}/sessions/token/${encodeURIComponent(token)}/filter`, {
-            method: "POST",
-            headers: { "content-type": "application/json", ...this.controlHeaders() },
-            body: JSON.stringify(body),
-        })
-        if (!res.ok) throw new Error(`filter apply failed: ${res.status} ${await res.text().catch(() => "")}`)
-        this.log("info", `session server filter applied (${filter.allow ? "allow" : "deny"}-list)`)
-    }
-
-    /** GET /health — the control-plane health snapshot. */
-    async health(): Promise<unknown> {
-        const res = await fetch(`${this.controlOrigin()}/health`, { headers: this.controlHeaders() })
-        if (!res.ok) throw new Error(`/health returned ${res.status}`)
-        return res.json()
-    }
-}

package/src/client/direct-tools.ts

@@ -1,146 +0,0 @@
-// Direct tool promotion: allowlist + search-mode, per the agreed design
-// (docs/adapter-design.md §Now/Later). Behavior follows pi-mcp-adapter's
-// directTools modes (MIT, © 2026 Nico Bailon).
-//
-// `combiner.directTools` on the shared-file entry is either a glob allowlist over
-// combined tool names — registered once at session start, cache-stable — or
-// "search": nothing registered upfront; the first mcp({search}) match activates
-// those tools as first-class Pi tools for the rest of the session (the adapter's
-// directTools:"search" semantics, on our own mid-session registerTool path).
-//
-// `directTools: true` is deliberately NOT offered: at combiner scale (hundreds of
-// tools) it burns the context window the proxy exists to save. Allowlists larger
-// than ~50 tools draw a loud warning and still register — an explicit list is the
-// user's call.
-
-import type { ToolDefinition } from "../pi.js"
-import type { CombinerConnection, ToolSummary } from "./connection.js"
-import { renderToolResult, textResult } from "./render.js"
-import { directToolRenderers } from "./renderers.js"
-
-export type DirectToolsSpec = string[] | "search"
-
-/** Names that must never be shadowed by a promoted tool (pi builtins). Callers add
- *  their own tool names on top. */
-export const RESERVED_TOOL_NAMES = ["read", "bash", "edit", "write", "grep", "find", "ls", "mcp", "glob"] as const
-
-/** Apply a server allow/deny filter to a combined tool list. Server names may
- *  contain underscores (gws_georgeharker), so matching is by PREFIX — a tool
- *  belongs to entry E iff its name starts `E_` (subsumes first-segment equality). */
-export function toolServerMatches(toolName: string, serverEntry: string): boolean {
-    return toolName.startsWith(`${serverEntry}_`)
-}
-
-/** Apply a server allow/deny filter to a combined tool list (`<server>_` prefix,
- *  underscore-safe via toolServerMatches). */
-export function applyServerFilter(
-    tools: ToolSummary[],
-    filter: { allow?: string[]; deny?: string[] } | undefined,
-): ToolSummary[] {
-    if (!filter) return tools
-    if (filter.allow?.length) {
-        return tools.filter((t) => filter.allow!.some((e) => toolServerMatches(t.name, e)))
-    }
-    if (filter.deny?.length) {
-        return tools.filter((t) => !filter.deny!.some((e) => toolServerMatches(t.name, e)))
-    }
-    return tools
-}
-
-/** fnmatch-lite: `*` → any run, `?` → one char, everything else literal. */
-export function globToRegExp(pattern: string): RegExp {
-    const escaped = pattern
-        .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-        .replace(/\*/g, ".*")
-        .replace(/\?/g, ".")
-    return new RegExp(`^${escaped}$`, "i")
-}
-
-export function matchesGlob(name: string, pattern: string): boolean {
-    return globToRegExp(pattern).test(name)
-}
-
-/** Resolve the allowlist spec against the combined tool list (server filter applied
- *  by the caller). Returns matching tools in list order. */
-export function resolveAllowlist(tools: ToolSummary[], patterns: string[]): ToolSummary[] {
-    const regexes = patterns.map(globToRegExp)
-    return tools.filter((t) => regexes.some((re) => re.test(t.name)))
-}
-
-/** Ensure a usable parameters object: pass the advertised JSON schema through when it
- *  is an object; repair anything else to an empty object schema. */
-function normalizeInputSchema(schema: unknown): Record<string, unknown> {
-    if (typeof schema === "object" && schema !== null && !Array.isArray(schema)) {
-        return schema as Record<string, unknown>
-    }
-    return { type: "object", properties: {} }
-}
-
-export type DirectToolDeps = {
-    connection: CombinerConnection
-    /** Names already registered (shared across syncs + search activation). */
-    registered: Set<string>
-    /** Reserved names to refuse (builtins + this extension's own tool names). */
-    reserved: Set<string>
-    register: (tool: ToolDefinition) => void
-    log: (level: "info" | "warn" | "error", message: string) => void
-}
-
-/** Build the Pi tool definition for one promoted combiner tool. */
-export function buildDirectTool(tool: ToolSummary, deps: DirectToolDeps): ToolDefinition {
-    return {
-        name: tool.name,
-        label: `MCP: ${tool.name}`,
-        description: tool.description ?? `Combiner tool ${tool.name}`,
-        parameters: normalizeInputSchema(tool.inputSchema),
-        ...directToolRenderers(tool.name),
-        execute: async () => {
-            const result = await deps.connection.callTool(tool.name, undefined)
-            const text = renderToolResult(result)
-            if ((result as { isError?: boolean })?.isError) throw new Error(text)
-            return textResult(text)
-        },
-    }
-}
-
-/** Register one tool if new and not reserved. Returns the name, or undefined when skipped. */
-export function registerDirectTool(tool: ToolSummary, deps: DirectToolDeps): string | undefined {
-    if (deps.registered.has(tool.name)) return undefined
-    if (deps.reserved.has(tool.name)) {
-        deps.log("warn", `directTools: refusing to register "${tool.name}" — reserved name`)
-        deps.registered.add(tool.name) // don't re-warn on every sync
-        return undefined
-    }
-    deps.registered.add(tool.name)
-    deps.register(buildDirectTool(tool, deps))
-    return tool.name
-}
-
-/** Allowlist sync: register every matching, not-yet-registered tool. */
-export function syncAllowlistTools(tools: ToolSummary[], patterns: string[], deps: DirectToolDeps): number {
-    const matches = resolveAllowlist(tools, patterns)
-    if (matches.length > 50) {
-        deps.log(
-            "warn",
-            `directTools: allowlist promotes ${matches.length} tools — every schema rides in every ` +
-                "request. Consider trimming (the mcp() proxy covers the rest).",
-        )
-    }
-    let added = 0
-    for (const tool of matches) {
-        if (registerDirectTool(tool, deps)) added++
-    }
-    return added
-}
-
-/** Search-mode activation: register matched tools (bounded per activation). Returns
- *  the newly activated names — empty when everything matched was already live. */
-export function activateFromSearch(matches: ToolSummary[], deps: DirectToolDeps, max = 10): string[] {
-    const activated: string[] = []
-    for (const tool of matches) {
-        if (activated.length >= max) break
-        if (deps.registered.has(tool.name)) continue
-        if (registerDirectTool(tool, deps)) activated.push(tool.name)
-    }
-    return activated
-}

package/src/client/resources.ts

@@ -1,137 +0,0 @@
-// MCP resources → read_* Pi tools, compatible with pi-mcp-adapter's conventions.
-//
-// A resource is server-exposed content addressed by URI (the GET to tools' POST);
-// each becomes a zero-parameter tool the model can call directly, named
-// `read_<sanitized>` (resourceNameToToolName ported verbatim). Reads go through the
-// combiner's proxied resources/read; text is guarded, binaries noted by size.
-//
-// Interactive mcp-app resources (mimeType `text/html;profile=mcp-app`, `ui://` URIs)
-// are flagged in the tool description — read_* returns their markup as text; the
-// interactive browser experience is the ext-apps host (later, see adapter-design.md).
-
-import type { ToolDefinition } from "../pi.js"
-import type { CombinerConnection, ResourceSummary } from "./connection.js"
-import type { ServerFilter } from "./config-ladder.js"
-import { renderResourceResult, textResult, toolUiResourceUri } from "./render.js"
-import { openInBrowser } from "./proxy-tool.js"
-import { callRenderer, resultRenderer } from "./renderers.js"
-
-/** Ported verbatim from pi-mcp-adapter's resource-tools.ts (MIT, © 2026 Nico Bailon). */
-export function resourceNameToToolName(name: string): string {
-    let result = name
-        .replace(/[^a-zA-Z0-9]/g, "_")
-        .replace(/_+/g, "_")
-        .replace(/^_+/, "") // Remove leading underscores
-        .replace(/_+$/, "") // Remove trailing underscores
-        .toLowerCase()
-
-    // Ensure we have a valid name
-    if (!result || /^\d/.test(result)) {
-        result = "resource" + (result ? "_" + result : "")
-    }
-
-    return result
-}
-
-export const MCP_APP_MIME = "text/html;profile=mcp-app"
-
-/** True for interactive ext-apps resources: read_* returns their markup AND
- *  surfaces the combiner UI-host URL (which serves the live widget). */
-export function isInteractiveResource(r: ResourceSummary): boolean {
-    return r.mimeType === MCP_APP_MIME || r.uri.startsWith("ui://")
-}
-
-/** Attribute a resource to an upstream server for filtering: ui:// URIs carry the
- *  server as the host component (ui://todoist/…); otherwise fall back to the name's
- *  leading word before a dash/underscore. */
-export function resourceServer(r: ResourceSummary): string | undefined {
-    const m = r.uri.match(/^[a-z][a-z0-9+.-]*:\/\/([^/?#]+)/i)
-    if (m?.[1]) return m[1].split(".")[0]?.toLowerCase()
-    const name = r.name ?? r.uri
-    const head = name.split(/[-_]/, 1)[0]
-    return head ? head.toLowerCase() : undefined
-}
-
-/** Apply the project server filter to a resource list (mirrors tool filtering;
- *  attribution by uri host, with `_`/`-` name-prefix fallback for underscore-named
- *  servers whose resources carry the full prefixed name). */
-export function filterResources(resources: ResourceSummary[], filter: ServerFilter | undefined): ResourceSummary[] {
-    if (!filter) return resources
-    const matches = (r: ResourceSummary, entry: string): boolean =>
-        resourceServer(r) === entry || (r.name ?? "").startsWith(`${entry}_`) || (r.name ?? "").startsWith(`${entry}-`)
-    if (filter.allow?.length) {
-        return resources.filter((r) => filter.allow!.some((e) => matches(r, e)))
-    }
-    if (filter.deny?.length) {
-        return resources.filter((r) => !filter.deny!.some((e) => matches(r, e)))
-    }
-    return resources
-}
-
-/** Discover resources and register one read_* tool each. Idempotent; returns count. */
-export async function syncResourceTools(
-    register: (tool: ToolDefinition) => void,
-    connection: CombinerConnection,
-    registered: Set<string>,
-    filter: ServerFilter | undefined,
-    notify: (message: string, level: "info" | "warn" | "error") => void,
-): Promise<number> {
-    let resources: ResourceSummary[] = []
-    try {
-        resources = filterResources(await connection.listResources(), filter)
-    } catch (e) {
-        notify(`resource discovery failed (${e instanceof Error ? e.message : String(e)})`, "warn")
-        return 0
-    }
-    for (const resource of resources) {
-        const label = resource.name ?? resource.uri
-        const toolName = `read_${resourceNameToToolName(label)}`
-        if (registered.has(toolName)) continue
-        registered.add(toolName)
-        const interactive = isInteractiveResource(resource)
-        const description = [
-            resource.description ?? `Read MCP resource ${resource.uri}`,
-            `uri: ${resource.uri}`,
-            resource.mimeType ? `type: ${resource.mimeType}` : undefined,
-            interactive
-                ? "interactive app resource — markup as text; the interactive widget opens from the URL appended to results"
-                : undefined,
-        ]
-            .filter(Boolean)
-            .join(" | ")
-        register({
-            name: toolName,
-            label: `MCP resource: ${label}`,
-            description,
-            promptSnippet: `Read MCP resource ${label}.`,
-            parameters: { type: "object", properties: {} },
-            renderCall: callRenderer(toolName, () => resource.uri),
-            renderResult: resultRenderer(() => toolName, toolName),
-            execute: async (
-                _toolCallId: string,
-                _params: Record<string, unknown>,
-                _signal: AbortSignal | undefined,
-                _onUpdate: unknown,
-                ctx: { hasUI: boolean } | undefined,
-            ) => {
-                try {
-                    const result = await connection.readResource(resource.uri)
-                    let text = renderResourceResult(result)
-                    // Interactive resources: the combiner's UI host serves the
-                    // widget for this session's token — surface + auto-open.
-                    if (interactive) {
-                        const url = connection.uiUrlFor(resource.uri)
-                        if (url) {
-                            text = `${text}\n\ninteractive: ${url}`
-                            if (ctx?.hasUI) openInBrowser(url)
-                        }
-                    }
-                    return textResult(text, { mode: "resource", uri: resource.uri })
-                } catch (e) {
-                    throw new Error(`${toolName}: resource read failed (${e instanceof Error ? e.message : String(e)})`)
-                }
-            },
-        })
-    }
-    return resources.length
-}