@heyditto/cli 2.30.0 → 2.32.0

package/README.md

@@ -499,6 +499,7 @@ Options shared by both commands:
 | `--session <id>` | reuse a Ditto session id so traces land in an existing thread |
 | `--resume [id]` / `-c, --continue` | resume a local session (`heyditto sessions`) / the agent's most recent conversation. Claude also takes a Claude session id or title here, including sessions started in Claude Desktop or plain `claude`, and runs in the directory that session ran in; with no value, a terminal gets a searchable picker. Claude's own `-r` / `--resume` / `-c` after `--` do the same. |
 | `--yolo` / `--yellow` / `--plan` | bypass permissions / auto-accept edits / plan mode (Claude only) |
+| `--mcp` / `--no-mcp` | attach the endpoint's tools to Claude Code as its own MCP servers, or keep them on the router (default: the endpoint's `claude_tool_surface`, else the router) |
 | `-p, --prompt <text>` | headless run: `claude -p` or `codex exec` |
 | `-m, --model <id>` | model to request (default: the agent's own model id passes through and the endpoint routes it) |
 | `-w, --worktree [name]` | run inside `<repo>/.worktrees/<name>` on a branch of that name; `.worktrees/` is added to `.gitignore` |
@@ -519,6 +520,25 @@ How the wiring works:
   a bare `mcp__ditto` denies them all) in your user, project or local
   `settings.json` are forwarded as `X-Ditto-Tool-Deny`, and the router refuses
   those tools for the session. The header can only add denials.
+- **Claude Code with `--mcp`** attaches the endpoint's tools as its own MCP
+  servers instead: `ditto` for Ditto's built-ins, plus one server per
+  connected app or MCP server (`ditto-github`, `ditto-jira`, …). Claude Code
+  discovers them with its own ToolSearch and calls them natively. Every call
+  still runs on Ditto (`/v1/mcp/<server>`) with the credentials Ditto holds and
+  behind the endpoint's approval gate and deny rules, and the router is told
+  not to offer the same tools again. The session key reaches the MCP headers
+  as `${DITTO_ROUTER_MCP_KEY}`, never argv or disk. Who asks before a gated
+  call is the endpoint's choice:
+
+  | Endpoint | What happens to a gated call |
+  | --- | --- |
+  | default | Ditto holds it for approval; Claude Code does not ask a second time |
+  | `client_approvals = true` | Claude Code asks; `--yolo` runs it without asking. Deny rules still refuse |
+
+  `client_approvals` hands approval to whoever runs the session, so only an
+  organization's managers can turn it on for an org endpoint. Code Mode and
+  the router's own tools stay the default; set `claude_tool_surface = "mcp"`
+  in an endpoint profile to make `--mcp` the default there.
 - **Codex** speaks the Responses API only, so the endpoint is injected as a
   `ditto` model provider via `-c` overrides (nothing is written to
   `~/.codex/config.toml`) with the key in `DITTO_INFERENCE_API_KEY`.
@@ -1039,7 +1059,7 @@ Settings: `owner`, `claude_prompt` / `codex_prompt` (`file`, `mode`,
 `precompact_at_tokens`, `max_tool_rounds`, `memory_depth`, `recall`, `record`,
 `record_trace`, `record_attachments`, `trace_retention_days`, `batch`,
 `batch_max_requests`, `tools`, `tool_approval_mode`, `auto_approve_tools`,
-`tool_deny`, `required_connections`, `kind_routes`, `model_routes`,
+`tool_deny`, `claude_native_tool_blocks`, `required_connections`, `kind_routes`, `model_routes`,
 `subagent_routes`, `aliases`.
 
 `tool_deny` lists router tools the endpoint never runs, whatever a client asks:
@@ -1048,6 +1068,12 @@ tool names, globs such as `"gmail__send_*"`, or a class (`"class:gated"`,
 refused. On an organization endpoint, changing it needs endpoint policy
 authority.
 
+`claude_native_tool_blocks = true` writes each router tool call and its result
+into Claude Code's own transcript (`server_tool_use` / `mcp_tool_result`), so
+the router rebuilds earlier turns from the transcript instead of its memory, and
+a deploy no longer loses them. Claude Code does not draw these blocks in its live
+view; they appear in the session file and in tools that read it.
+
 Layers: workspace `.ditto/` (a parent folder of many repos) < repository `.ditto/` <
 ignored `.ditto/local.toml` < flags. Secrets are never literals: use `secret://`
 references. Paths are repository-relative and cannot escape it.

package/dist/agents/claude-deny.js

@@ -11,6 +11,8 @@ import path from "node:path";
 export const TOOL_DENY_HEADER = "X-Ditto-Tool-Deny";
 const NAMESPACE = "mcp__ditto";
 const VALID = /^[A-Za-z0-9_.*-]+$/;
+/** Native MCP mode's per-source servers (claude-mcp.ts): mcp__ditto-<source>[__<tool>]. */
+const SOURCE_SERVER = /^mcp__ditto-([a-z0-9][a-z0-9_-]*?)(?:__(.+))?$/i;
 /**
  * The deny rules for router tools, from every settings file Claude Code may
  * read for this directory: user, then project and local settings in the
@@ -45,6 +47,13 @@ export function claudeDittoDenyRules(cwd, env) {
             else if (rule.toLowerCase().startsWith(`${NAMESPACE}__`) && VALID.test(rule)) {
                 rules.push(rule.slice(NAMESPACE.length + 2));
             }
+            else if (VALID.test(rule)) {
+                // The router names a source's tools <source>__<tool>, so a rule on
+                // the server mcp__ditto-github is the router rule github__*.
+                const source = SOURCE_SERVER.exec(rule);
+                if (source)
+                    rules.push(`${source[1]}__${source[2] ?? "*"}`);
+            }
         }
     }
     return [...new Set(rules)];

package/dist/agents/claude-deny.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-deny.js","sourceRoot":"","sources":["../../src/agents/claude-deny.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEpD,MAAM,SAAS,GAAG,YAAY,CAAC;AAC/B,MAAM,KAAK,GAAG,oBAAoB,CAAC;AAEnC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,GAAsB;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0C,CAAC,WAAW,EAAE,IAAI,CAAC;QAC5G,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,SAAS,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,+FAA+F;AAC/F,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}
+{"version":3,"file":"claude-deny.js","sourceRoot":"","sources":["../../src/agents/claude-deny.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEpD,MAAM,SAAS,GAAG,YAAY,CAAC;AAC/B,MAAM,KAAK,GAAG,oBAAoB,CAAC;AACnC,2FAA2F;AAC3F,MAAM,aAAa,GAAG,iDAAiD,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,GAAsB;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAC7I,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0C,CAAC,WAAW,EAAE,IAAI,CAAC;QAC5G,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAS;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,CAAC;iBAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,SAAS,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;iBAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,mEAAmE;gBACnE,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,MAAM;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,+FAA+F;AAC/F,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/agents/claude-mcp.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Native MCP mode for Claude Code (DITTO-1497).
+ *
+ * The router normally runs an endpoint's tools itself: injected into each
+ * request, or behind Code Mode's search_tools/run_code sandbox. In this mode
+ * the endpoint's tools arrive as Claude Code's own MCP servers instead, one
+ * per source ("ditto" for Ditto's built-ins, "ditto-github", "ditto-linear",
+ * …), so Claude Code discovers them with its own ToolSearch and calls them
+ * natively. Every call still executes on Ditto (`/v1/mcp/{server}`) with the
+ * credentials Ditto holds, behind the endpoint's approval gate and deny rules.
+ *
+ * Who asks before a gated call is the endpoint's choice (`clientApprovals`):
+ *
+ *  - off (default): Ditto holds gated calls itself, so every Ditto server is
+ *    allowed here and nobody is asked twice;
+ *  - on: Ditto holds nothing on this surface. Calls Ditto would have held get
+ *    an `ask` rule, and `--yolo` (bypass) runs them without one.
+ */
+/** Tells the router this session attached the tools itself, so it injects none. */
+export declare const TOOL_SURFACE_HEADER = "X-Ditto-Tool-Surface";
+export declare const TOOL_SURFACE_MCP = "mcp";
+/**
+ * The endpoint key reaches Claude Code's MCP headers through this variable,
+ * which Claude Code expands in `--mcp-config` (`${VAR}`), so the key never
+ * lands in a file or in argv.
+ */
+export declare const MCP_KEY_ENV = "DITTO_ROUTER_MCP_KEY";
+export interface McpCatalogTool {
+    name: string;
+    tier: string;
+    /** Ditto's policy holds this call for a person. */
+    approval: boolean;
+}
+export interface McpCatalogServer {
+    name: string;
+    url: string;
+    tools: McpCatalogTool[];
+}
+/** GET /v1/mcp. */
+export interface McpCatalog {
+    endpoint: string;
+    approvalMode: string;
+    clientApprovals: boolean;
+    servers: McpCatalogServer[];
+}
+/** What a Claude launch needs to attach the catalog. */
+export interface ClaudeMcpAttachment {
+    /** The `--mcp-config` JSON. */
+    config: string;
+    /** permissions.allow / permissions.ask for `--settings`. */
+    allow: string[];
+    ask: string[];
+    servers: number;
+    tools: number;
+    clientApprovals: boolean;
+}
+/** Claude Code server name for a catalog server: the built-ins keep "ditto", the rest are "ditto-<source>". */
+export declare function claudeServerName(server: string): string;
+/** Reads the endpoint's MCP catalog with the session's own key. */
+export declare function fetchMcpCatalog(baseUrl: string, apiKey: string, sessionId: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<McpCatalog>;
+/**
+ * The Claude Code configuration for a catalog: one http MCP server per
+ * source, and the permission rules that put the endpoint's approval policy
+ * into Claude Code's own prompts.
+ */
+export declare function claudeMcpAttachment(catalog: McpCatalog, sessionId: string, opts?: {
+    yolo?: boolean;
+}): ClaudeMcpAttachment;
+type Json = Record<string, unknown>;
+/** Objects merge key by key, arrays concatenate without duplicates, anything else: b wins. */
+export declare function mergeSettings(a: Json, b: Json): Json;
+export interface SettingsIO {
+    /** Claude's launch directory: a relative settings path means a file there. */
+    cwd?: string;
+    read?: (file: string) => string;
+    /** Writes merged settings somewhere only this user can read; returns the path. */
+    writePrivate?: (json: string) => string;
+}
+/**
+ * Removes settings copies whose CLI is gone (killed by a signal before its exit
+ * cleanup ran). Liveness, not age: a session can run for days, and its Claude
+ * keeps reading its settings for as long as it runs.
+ */
+export declare function sweepStaleSettings(tmp: string, isAlive?: (pid: number) => boolean): void;
+/**
+ * A private copy of merged settings for the life of this process. A user's
+ * settings file can hold secrets, so its contents never go into Claude's
+ * argv (visible in process listings); the copy is a 0600 file in a 0700
+ * directory. Copies are named by content, so a long headless session that
+ * re-plans every turn reuses one file per distinct value instead of piling
+ * them up. The directory goes when the CLI exits; one left by a signal is
+ * swept by a later launch once its process is gone. No signal handlers are
+ * installed: the launcher owns Ctrl+C, and re-raising a signal here would cut
+ * its shutdown short.
+ */
+export declare function writePrivateSettings(json: string, tmp?: string): string;
+/**
+ * Adds settings to a Claude argv. Claude Code reads a single `--settings`, so
+ * the one already in the argv absorbs the new keys rather than a second flag
+ * silently replacing either. Inline JSON is merged in place. A settings file is
+ * read from Claude's launch directory and merged into a private copy whose path
+ * replaces it. A file that cannot be read stops the launch, since dropping it
+ * would lose the user's settings and dropping ours their MCP permissions.
+ */
+export declare function withClaudeSettings(args: string[], settings: Json, io?: SettingsIO): string[];
+/** The permission settings an attachment contributes. */
+export declare function attachmentSettings(mcp: ClaudeMcpAttachment): Json;
+export {};

package/dist/agents/claude-mcp.js

@@ -0,0 +1,247 @@
+import { createHash } from "node:crypto";
+import { chmodSync, existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/**
+ * Native MCP mode for Claude Code (DITTO-1497).
+ *
+ * The router normally runs an endpoint's tools itself: injected into each
+ * request, or behind Code Mode's search_tools/run_code sandbox. In this mode
+ * the endpoint's tools arrive as Claude Code's own MCP servers instead, one
+ * per source ("ditto" for Ditto's built-ins, "ditto-github", "ditto-linear",
+ * …), so Claude Code discovers them with its own ToolSearch and calls them
+ * natively. Every call still executes on Ditto (`/v1/mcp/{server}`) with the
+ * credentials Ditto holds, behind the endpoint's approval gate and deny rules.
+ *
+ * Who asks before a gated call is the endpoint's choice (`clientApprovals`):
+ *
+ *  - off (default): Ditto holds gated calls itself, so every Ditto server is
+ *    allowed here and nobody is asked twice;
+ *  - on: Ditto holds nothing on this surface. Calls Ditto would have held get
+ *    an `ask` rule, and `--yolo` (bypass) runs them without one.
+ */
+/** Tells the router this session attached the tools itself, so it injects none. */
+export const TOOL_SURFACE_HEADER = "X-Ditto-Tool-Surface";
+export const TOOL_SURFACE_MCP = "mcp";
+/**
+ * The endpoint key reaches Claude Code's MCP headers through this variable,
+ * which Claude Code expands in `--mcp-config` (`${VAR}`), so the key never
+ * lands in a file or in argv.
+ */
+export const MCP_KEY_ENV = "DITTO_ROUTER_MCP_KEY";
+/** Claude Code server name for a catalog server: the built-ins keep "ditto", the rest are "ditto-<source>". */
+export function claudeServerName(server) {
+    return server === "ditto" ? "ditto" : `ditto-${server}`;
+}
+/** A stalled catalog read must not hold up Claude's launch; the caller falls back to the router. */
+const CATALOG_TIMEOUT_MS = 15_000;
+/** Reads the endpoint's MCP catalog with the session's own key. */
+export async function fetchMcpCatalog(baseUrl, apiKey, sessionId, fetchImpl = fetch, timeoutMs = CATALOG_TIMEOUT_MS) {
+    const url = `${baseUrl.replace(/\/+$/, "")}/mcp`;
+    const res = await fetchImpl(url, {
+        headers: { Authorization: `Bearer ${apiKey}`, "X-Ditto-Session-Id": sessionId, Accept: "application/json" },
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!res.ok) {
+        let detail = "";
+        try {
+            const body = (await res.json());
+            detail = body.error?.message ?? "";
+        }
+        catch {
+            // A body that is not JSON adds nothing the status does not say.
+        }
+        throw new Error(`GET ${url} → ${res.status}${detail ? `: ${detail}` : ""}`);
+    }
+    const catalog = (await res.json());
+    if (!Array.isArray(catalog.servers))
+        throw new Error(`GET ${url}: not an MCP catalog`);
+    return catalog;
+}
+/**
+ * The Claude Code configuration for a catalog: one http MCP server per
+ * source, and the permission rules that put the endpoint's approval policy
+ * into Claude Code's own prompts.
+ */
+export function claudeMcpAttachment(catalog, sessionId, opts = {}) {
+    const mcpServers = {};
+    const allow = [];
+    const ask = [];
+    let tools = 0;
+    for (const server of catalog.servers) {
+        if (server.tools.length === 0)
+            continue;
+        const name = claudeServerName(server.name);
+        mcpServers[name] = {
+            type: "http",
+            url: server.url,
+            headers: { Authorization: `Bearer \${${MCP_KEY_ENV}}`, "X-Ditto-Session-Id": sessionId },
+        };
+        tools += server.tools.length;
+        if (!catalog.clientApprovals) {
+            // Ditto's gate is the authority here; a Claude prompt on top would ask twice.
+            allow.push(`mcp__${name}`);
+            continue;
+        }
+        for (const tool of server.tools) {
+            const rule = `mcp__${name}__${tool.name}`;
+            if (!tool.approval)
+                allow.push(rule);
+            // Under bypass the user chose not to be asked; an ask rule would still prompt.
+            else if (!opts.yolo)
+                ask.push(rule);
+        }
+    }
+    return {
+        config: JSON.stringify({ mcpServers }),
+        allow,
+        ask,
+        servers: Object.keys(mcpServers).length,
+        tools,
+        clientApprovals: catalog.clientApprovals,
+    };
+}
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Objects merge key by key, arrays concatenate without duplicates, anything else: b wins. */
+export function mergeSettings(a, b) {
+    const out = { ...a };
+    for (const [k, v] of Object.entries(b)) {
+        const cur = Object.prototype.hasOwnProperty.call(out, k) ? out[k] : undefined;
+        let value = v;
+        if (isObject(cur) && isObject(v))
+            value = mergeSettings(cur, v);
+        else if (Array.isArray(cur) && Array.isArray(v))
+            value = [...new Set([...cur, ...v])];
+        // defineProperty, so a "__proto__" key stays data instead of hitting the setter.
+        Object.defineProperty(out, k, { value, enumerable: true, configurable: true, writable: true });
+    }
+    return out;
+}
+const PRIVATE_SETTINGS_PREFIX = "ditto-claude-settings-";
+/** One private directory per temp root for the life of this process. */
+const privateSettingsDirs = new Map();
+/** The pid a settings directory belongs to: ditto-claude-settings-<pid>-<random>. */
+function ownerPid(name) {
+    const m = /^ditto-claude-settings-(\d+)-/.exec(name);
+    return m ? Number(m[1]) : undefined;
+}
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM: the process exists, it is just not ours to signal.
+        return err.code === "EPERM";
+    }
+}
+/**
+ * Removes settings copies whose CLI is gone (killed by a signal before its exit
+ * cleanup ran). Liveness, not age: a session can run for days, and its Claude
+ * keeps reading its settings for as long as it runs.
+ */
+export function sweepStaleSettings(tmp, isAlive = alive) {
+    let entries;
+    try {
+        entries = readdirSync(tmp);
+    }
+    catch {
+        return;
+    }
+    const uid = process.getuid?.();
+    for (const name of entries) {
+        if (!name.startsWith(PRIVATE_SETTINGS_PREFIX))
+            continue;
+        const pid = ownerPid(name);
+        if (pid === undefined || pid === process.pid || isAlive(pid))
+            continue;
+        const dir = path.join(tmp, name);
+        try {
+            if (uid === undefined || statSync(dir).uid === uid)
+                rmSync(dir, { recursive: true, force: true });
+        }
+        catch {
+            // Another process removed it, or it is not ours to read: leave it.
+        }
+    }
+}
+/**
+ * A private copy of merged settings for the life of this process. A user's
+ * settings file can hold secrets, so its contents never go into Claude's
+ * argv (visible in process listings); the copy is a 0600 file in a 0700
+ * directory. Copies are named by content, so a long headless session that
+ * re-plans every turn reuses one file per distinct value instead of piling
+ * them up. The directory goes when the CLI exits; one left by a signal is
+ * swept by a later launch once its process is gone. No signal handlers are
+ * installed: the launcher owns Ctrl+C, and re-raising a signal here would cut
+ * its shutdown short.
+ */
+export function writePrivateSettings(json, tmp = os.tmpdir()) {
+    let dir = privateSettingsDirs.get(tmp);
+    if (!dir) {
+        sweepStaleSettings(tmp);
+        const created = mkdtempSync(path.join(tmp, `${PRIVATE_SETTINGS_PREFIX}${process.pid}-`));
+        chmodSync(created, 0o700);
+        process.once("exit", () => rmSync(created, { recursive: true, force: true }));
+        privateSettingsDirs.set(tmp, created);
+        dir = created;
+    }
+    const file = path.join(dir, `${createHash("sha256").update(json).digest("hex").slice(0, 16)}.json`);
+    if (!existsSync(file))
+        writeFileSync(file, json, { mode: 0o600 });
+    return file;
+}
+/**
+ * Adds settings to a Claude argv. Claude Code reads a single `--settings`, so
+ * the one already in the argv absorbs the new keys rather than a second flag
+ * silently replacing either. Inline JSON is merged in place. A settings file is
+ * read from Claude's launch directory and merged into a private copy whose path
+ * replaces it. A file that cannot be read stops the launch, since dropping it
+ * would lose the user's settings and dropping ours their MCP permissions.
+ */
+export function withClaudeSettings(args, settings, io = {}) {
+    const read = io.read ?? ((f) => readFileSync(f, "utf8"));
+    const writePrivate = io.writePrivate ?? writePrivateSettings;
+    if (Object.keys(settings).length === 0)
+        return args;
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        const inline = a.startsWith("--settings=");
+        if (a !== "--settings" && !inline)
+            continue;
+        const value = inline ? a.slice("--settings=".length) : args[i + 1];
+        if (value === undefined)
+            continue;
+        const isJSON = value.trim().startsWith("{");
+        let parsed;
+        try {
+            parsed = JSON.parse(isJSON ? value : read(path.resolve(io.cwd ?? process.cwd(), value)));
+        }
+        catch (err) {
+            throw new Error(`--settings ${value}: cannot be merged with native MCP permissions (${err.message})`);
+        }
+        if (!isObject(parsed))
+            throw new Error(`--settings ${value}: not a JSON object`);
+        const json = JSON.stringify(mergeSettings(parsed, settings));
+        const merged = isJSON ? json : writePrivate(json);
+        const out = [...args];
+        if (inline)
+            out[i] = `--settings=${merged}`;
+        else
+            out[i + 1] = merged;
+        return out;
+    }
+    return [...args, "--settings", JSON.stringify(settings)];
+}
+/** The permission settings an attachment contributes. */
+export function attachmentSettings(mcp) {
+    const permissions = {};
+    if (mcp.allow.length)
+        permissions.allow = mcp.allow;
+    if (mcp.ask.length)
+        permissions.ask = mcp.ask;
+    return Object.keys(permissions).length ? { permissions } : {};
+}
+//# sourceMappingURL=claude-mcp.js.map

package/dist/agents/claude-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-mcp.js","sourceRoot":"","sources":["../../src/agents/claude-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;;;;;;GAiBG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAmClD,+GAA+G;AAC/G,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED,oGAAoG;AACpG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,MAAc,EACd,SAAiB,EACjB,YAA0B,KAAK,EAC/B,SAAS,GAAG,kBAAkB;IAE9B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,oBAAoB,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3G,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqC,CAAC;YACpE,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAe,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,sBAAsB,CAAC,CAAC;IACvF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmB,EAAE,SAAiB,EAAE,OAA2B,EAAE;IACvG,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,UAAU,CAAC,IAAI,CAAC,GAAG;YACjB,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,OAAO,EAAE,EAAE,aAAa,EAAE,aAAa,WAAW,GAAG,EAAE,oBAAoB,EAAE,SAAS,EAAE;SACzF,CAAC;QACF,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,8EAA8E;YAC9E,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,QAAQ,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,+EAA+E;iBAC1E,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC;QACtC,KAAK;QACL,GAAG;QACH,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM;QACvC,KAAK;QACL,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC;AACJ,CAAC;AAID,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,CAAO,EAAE,CAAO;IAC5C,MAAM,GAAG,GAAS,EAAE,GAAG,CAAC,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,KAAK,GAAY,CAAC,CAAC;QACvB,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC;YAAE,KAAK,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;aAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,iFAAiF;QACjF,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AACzD,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEtD,qFAAqF;AACrF,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,KAAK,CAAC,GAAW;IACxB,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4DAA4D;QAC5D,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,UAAoC,KAAK;IACvF,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;YAAE,SAAS;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,GAAG;gBAAE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAc,EAAE,CAAC,MAAM,EAAE;IAC1E,IAAI,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACzF,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9E,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtC,GAAG,GAAG,OAAO,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACpG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc,EAAE,QAAc,EAAE,KAAiB,EAAE;IACpF,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,YAAY,IAAI,CAAC,MAAM;YAAE,SAAS;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,mDAAoD,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,qBAAqB,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,IAAI,MAAM;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,cAAc,MAAM,EAAE,CAAC;;YACvC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,kBAAkB,CAAC,GAAwB;IACzD,MAAM,WAAW,GAAS,EAAE,CAAC;IAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM;QAAE,WAAW,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACpD,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM;QAAE,WAAW,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAChE,CAAC"}

package/dist/agents/claude.js

@@ -1,4 +1,5 @@
 import { TOOL_DENY_HEADER } from "./claude-deny.js";
+import { MCP_KEY_ENV, TOOL_SURFACE_HEADER, TOOL_SURFACE_MCP, attachmentSettings, withClaudeSettings } from "./claude-mcp.js";
 import { SESSION_HEADER, apiRootOf } from "./types.js";
 /**
  * Builds the `claude` invocation.
@@ -31,9 +32,15 @@ export function planClaude(input) {
         args.push("--model", input.model);
     if (input.prompt !== undefined)
         args.push("-p", input.prompt);
+    // Native MCP mode: the endpoint's tools as Claude Code's own servers, and
+    // the router told not to inject them a second time.
+    if (input.mcp)
+        args.push("--mcp-config", input.mcp.config);
     args.push(...input.passthrough);
+    const finalArgs = input.mcp ? withClaudeSettings(args, attachmentSettings(input.mcp), { cwd: input.cwd }) : args;
     const deny = input.toolDeny?.length ? `${TOOL_DENY_HEADER}: ${input.toolDeny.join(",")}` : undefined;
-    const headers = [input.env.ANTHROPIC_CUSTOM_HEADERS?.trim(), `${SESSION_HEADER}: ${input.sessionId}`, deny]
+    const surface = input.mcp ? `${TOOL_SURFACE_HEADER}: ${TOOL_SURFACE_MCP}` : undefined;
+    const headers = [input.env.ANTHROPIC_CUSTOM_HEADERS?.trim(), `${SESSION_HEADER}: ${input.sessionId}`, deny, surface]
         .filter((h) => Boolean(h))
         .join("\n");
     const envSet = {
@@ -43,6 +50,8 @@ export function planClaude(input) {
     };
     if (input.model)
         envSet.ANTHROPIC_MODEL = input.model;
+    if (input.mcp)
+        envSet[MCP_KEY_ENV] = input.apiKey;
     // Claude Code's server-side auto-mode classifier needs the dangerous-tool-use
     // beta and `safeguards` field, which the router does not forward; a rejection
     // denies every auto-mode tool use. Decide locally unless the caller chose.
@@ -55,7 +64,7 @@ export function planClaude(input) {
         envSet.CLAUDE_CODE_GATEWAY_HINT_HEADERS = "1";
     return {
         command: "claude",
-        args,
+        args: finalArgs,
         envSet,
         envUnset: ["ANTHROPIC_API_KEY"],
         installHint: "install Claude Code: npm i -g @anthropic-ai/claude-code (or see https://code.claude.com)",

package/dist/agents/claude.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../src/agents/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAoC,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEzF;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;SACvD,IAAI,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;SAChE,IAAI,KAAK,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAE5D,uEAAuE;IACvE,2EAA2E;IAC3E,iBAAiB;IACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IACzJ,IAAI,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;SACrD,IAAI,KAAK,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SAC9C,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/D,IAAI,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IAEhC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,gBAAgB,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,EAAE,GAAG,cAAc,KAAK,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC;SACxG,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,MAAM,GAA2B;QACrC,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,MAAM;QAClC,wBAAwB,EAAE,OAAO;KAClC,CAAC;IACF,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IACtD,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,KAAK,CAAC,GAAG,CAAC,4BAA4B,KAAK,SAAS;QAAE,MAAM,CAAC,4BAA4B,GAAG,GAAG,CAAC;IACpG,uEAAuE;IACvE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,KAAK,CAAC,GAAG,CAAC,gCAAgC,KAAK,SAAS;QAAE,MAAM,CAAC,gCAAgC,GAAG,GAAG,CAAC;IAE5G,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,CAAC,mBAAmB,CAAC;QAC/B,WAAW,EAAE,0FAA0F;KACxG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAiC,CAAC;IACtC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,GAAG,IAAI,CAAC;gBACd,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;;gBAAM,MAAM,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;aAC9E,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,YAAY;YAAE,IAAI,GAAG,IAAI,CAAC;;YAClD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC"}
+{"version":3,"file":"claude.js","sourceRoot":"","sources":["../../src/agents/claude.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC7H,OAAO,EAAoC,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEzF;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB;IACzC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;SACvD,IAAI,KAAK,CAAC,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,aAAa,CAAC,CAAC;SAChE,IAAI,KAAK,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAE5D,uEAAuE;IACvE,2EAA2E;IAC3E,iBAAiB;IACjB,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IACzJ,IAAI,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;SACrD,IAAI,KAAK,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SAC9C,IAAI,CAAC,QAAQ;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAE/D,IAAI,KAAK,CAAC,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9D,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,KAAK,CAAC,GAAG;QAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjH,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,gBAAgB,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,mBAAmB,KAAK,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,EAAE,GAAG,cAAc,KAAK,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC;SACjH,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,MAAM,GAA2B;QACrC,kBAAkB,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5C,oBAAoB,EAAE,KAAK,CAAC,MAAM;QAClC,wBAAwB,EAAE,OAAO;KAClC,CAAC;IACF,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC;IACtD,IAAI,KAAK,CAAC,GAAG;QAAE,MAAM,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IAClD,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,KAAK,CAAC,GAAG,CAAC,4BAA4B,KAAK,SAAS;QAAE,MAAM,CAAC,4BAA4B,GAAG,GAAG,CAAC;IACpG,uEAAuE;IACvE,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,KAAK,CAAC,GAAG,CAAC,gCAAgC,KAAK,SAAS;QAAE,MAAM,CAAC,gCAAgC,GAAG,GAAG,CAAC;IAE5G,OAAO;QACL,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,SAAS;QACf,MAAM;QACN,QAAQ,EAAE,CAAC,mBAAmB,CAAC;QAC/B,WAAW,EAAE,0FAA0F;KACxG,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,MAAiC,CAAC;IACtC,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChD,MAAM,GAAG,IAAI,CAAC;gBACd,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;;gBAAM,MAAM,GAAG,IAAI,CAAC;QACvB,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;aAC9E,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,YAAY;YAAE,IAAI,GAAG,IAAI,CAAC;;YAClD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC"}

package/dist/agents/launch.d.ts

@@ -33,7 +33,15 @@ export interface LaunchOptions {
      * `claude -p` / `codex exec` turn in the session's thread until Ctrl+C.
      */
     headless?: boolean;
+    /**
+     * Claude only: attach the endpoint's tools as Claude Code MCP servers
+     * (`--mcp`) or keep them on the router (`--no-mcp`). Unset follows the
+     * endpoint's `claude_tool_surface` option, else the router.
+     */
+    mcp?: boolean;
 }
+/** `--mcp` / `--no-mcp`, else the endpoint's `claude_tool_surface`, else the router. */
+export declare function wantsMcp(options: Pick<LaunchOptions, "mcp">, endpoint: Pick<InferenceEndpoint, "providerOptions">): boolean;
 /** Interactive numbered picker; also accepts a slug or id. Exported for `heyditto endpoints pick`. */
 export declare function pickEndpoint(endpoints: InferenceEndpoint[], defaultSlug?: string): Promise<InferenceEndpoint>;
 /** Refuses to launch against an endpoint the backend marked inactive (e.g. awaiting the user's plan). */

package/dist/agents/launch.js

@@ -14,6 +14,7 @@ import { findProfileEndpoint, repoDefaultProfile } from "../dittoconfig/profiles
 import { err as c } from "../ui.js";
 import { holdNotesForTui, releaseNotes, writeNote } from "../terminal-note.js";
 import { claudeDittoDenyRules } from "./claude-deny.js";
+import { claudeMcpAttachment, fetchMcpCatalog } from "./claude-mcp.js";
 import { liftResumeFlags, planClaude } from "./claude.js";
 import { resolveClaudeResume, transcriptCwd } from "./claude-resume.js";
 import { findTranscriptById, listTranscriptsIn } from "./claude-transcripts.js";
@@ -29,6 +30,18 @@ import { claudeHookSettings, codexNotifyOverride, hookScriptPath, startHookServe
 import { loadPty, spawnInPty } from "../remote/pty.js";
 import { checkpointPush } from "../teleport/commands.js";
 const DRY_RUN_KEY = "ditto_inf_<minted-at-launch>";
+/** `--mcp` / `--no-mcp`, else the endpoint's `claude_tool_surface`, else the router. */
+export function wantsMcp(options, endpoint) {
+    if (options.mcp !== undefined)
+        return options.mcp;
+    return endpoint.providerOptions?.claude_tool_surface === "mcp";
+}
+function mcpBanner(mcp, dryRun) {
+    if (!mcp)
+        return dryRun ? "mcp (catalog read at launch)" : c("yellow", "router (MCP not attached)");
+    const asks = mcp.clientApprovals ? "Claude Code asks" : "Ditto holds gated calls";
+    return `mcp ${c("dim", `(${mcp.servers} servers, ${mcp.tools} tools; ${asks})`)}`;
+}
 function log(line, options) {
     writeNote(`${c("dim", "ditto:")} ${line}\n`, options);
 }
@@ -462,6 +475,24 @@ export async function launchHarness(harness, rawArgs, options) {
             env: process.env,
         })
         : undefined;
+    // Native MCP mode reads the endpoint's tool catalog with the key just
+    // minted, so what Claude Code attaches is exactly what this key may reach.
+    // A catalog that cannot be read falls back to the router's own tools rather
+    // than launching an agent with none.
+    const wantMcp = harness === "claude" && wantsMcp(options, endpoint);
+    let mcp;
+    if (wantMcp && key?.key) {
+        try {
+            const attachment = claudeMcpAttachment(await fetchMcpCatalog(catalog.baseUrl, key.key, sessionId), sessionId, { yolo: options.yolo });
+            if (attachment.tools > 0)
+                mcp = attachment;
+            else
+                log(`${c("yellow", "native MCP unavailable")} (the catalog has no tools); the router keeps this endpoint's tools`);
+        }
+        catch (err) {
+            log(`${c("yellow", "native MCP unavailable")} (${err.message}); the router keeps this endpoint's tools`);
+        }
+    }
     const plan = planFor(harness, {
         baseUrl: catalog.baseUrl,
         apiKey: key?.key ?? DRY_RUN_KEY,
@@ -475,6 +506,8 @@ export async function launchHarness(harness, rawArgs, options) {
         plan: options.plan,
         passthrough,
         toolDeny: harness === "claude" ? claudeDittoDenyRules(cwd, process.env) : undefined,
+        mcp,
+        cwd,
         env: process.env,
     }, grokHome);
     const field = (name, value) => `${c("dim", `${name}=`)}${value}`;
@@ -485,6 +518,7 @@ export async function launchHarness(harness, rawArgs, options) {
         field("expires", `${expiresIn}${options.keepKey ? "" : c("dim", " (revoked on exit)")}`),
         budget !== undefined ? field("budget", `${budget.toLocaleString()} tokens`) : undefined,
         field("session", c("bold", sessionId)),
+        wantMcp ? field("tools", mcpBanner(mcp, options.dryRun)) : undefined,
     ]
         .filter(Boolean)
         .join("  ");
@@ -501,6 +535,10 @@ export async function launchHarness(harness, rawArgs, options) {
             cwd,
             endpoint: { id: endpoint.id, slug: endpoint.slug, model: endpoint.model },
             sessionId,
+            // A dry run reads no catalog, so the plan above is the router's; say
+            // which surface a real launch would ask for, separately.
+            toolSurface: mcp ? "mcp" : "router",
+            toolSurfaceRequested: wantMcp ? "mcp" : "router",
             key: { name: keyName, expiresIn, spendLimitTokens: budget ?? null },
         }, null, 2)}\n`);
         return;
@@ -537,6 +575,7 @@ export async function launchHarness(harness, rawArgs, options) {
                 options,
                 record: nextRecord,
                 grokHome,
+                mcp,
                 claudeStarted: harness === "claude" && !resumeLast ? Boolean(transcript) : undefined,
             });
         }
@@ -757,6 +796,8 @@ async function runHeadless(harness, ctx) {
                 yolo: ctx.options.yolo,
                 yellow: ctx.options.yellow,
                 toolDeny: harness === "claude" ? claudeDittoDenyRules(ctx.cwd, process.env) : undefined,
+                mcp: ctx.mcp,
+                cwd: ctx.cwd,
                 env: process.env,
             },
             prompt,