@inhuman.tools/harness 0.0.0-stage → 0.2.0

package/dist/providers/mcp/stdio-driver.js

@@ -0,0 +1,129 @@
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { McpStdioToolActor } from "./actor.js";
+import { isMcpEnabled } from "./config.js";
+import { McpDriverConnection } from "./mcp-connection.js";
+import { mcpSecretsSchema, mcpStdioConfigurationSchema } from "./schemas/mcp.js";
+import { buildMcpChildEnvExtras, secretEnv, StderrRing } from "./stdio-env.js";
+export class McpStdioDriverConnection extends McpDriverConnection {
+    static configurationSchema = mcpStdioConfigurationSchema;
+    static secretsSchema = mcpSecretsSchema;
+    static configurationLabel = "mcp-stdio";
+    createToolActor(expectation) {
+        return new McpStdioToolActor(expectation, this);
+    }
+    #transport = null;
+    #stderrRing = new StderrRing();
+    #detachStderr = null;
+    stderrTail() {
+        return this.#stderrRing.tail();
+    }
+    async bootstrap() {
+        if (!isMcpEnabled(this.settings)) {
+            this.state.tools = [];
+            return;
+        }
+        const command = this.settings.command.trim();
+        const cwd = this.settings.cwd?.trim();
+        const env = buildMcpChildEnvExtras({
+            secrets: secretEnv(this.secrets),
+            envForward: this.settings.envForward,
+        });
+        this.#stderrRing.clear();
+        const transport = new StdioClientTransport({
+            command,
+            args: this.settings.args ? [...this.settings.args] : undefined,
+            cwd: cwd === "" ? undefined : cwd,
+            env,
+            stderr: "pipe",
+        });
+        const stderr = transport.stderr;
+        const onStderrData = (chunk) => {
+            this.#stderrRing.push(chunk);
+        };
+        if (stderr && typeof stderr.on === "function") {
+            stderr.on("data", onStderrData);
+            stderr.resume?.();
+        }
+        this.#detachStderr = () => {
+            if (stderr && typeof stderr.off === "function")
+                stderr.off("data", onStderrData);
+        };
+        const prevOnClose = transport.onclose;
+        // eslint-disable-next-line unicorn/prefer-add-event-listener -- MCP Transport uses onclose callback, not EventTarget
+        transport.onclose = () => {
+            try {
+                prevOnClose?.();
+            }
+            catch {
+                /* ignore */
+            }
+            if (this.#transport === transport) {
+                this.client = null;
+                this.#transport = null;
+                this.#detachStderr?.();
+                this.#detachStderr = null;
+                if (this.bootstrapDone)
+                    this.failReady(new Error("mcp-stdio: transport closed"));
+            }
+        };
+        let client;
+        try {
+            client = await this.connectMcpClient(transport);
+            this.#transport = transport;
+        }
+        catch (error) {
+            this.#detachStderr?.();
+            this.#detachStderr = null;
+            try {
+                await transport.close();
+            }
+            catch {
+                /* ignore */
+            }
+            const tail = this.#stderrRing.tail();
+            const msg = error instanceof Error ? error.message : String(error);
+            throw new Error(tail ? `mcp: connect failed: ${msg}\n--- stderr ---\n${tail}` : `mcp: connect failed: ${msg}`);
+        }
+        try {
+            this.state.tools = [...(await this.requestMcpListTools(client))];
+        }
+        catch (error) {
+            const tail = this.#stderrRing.tail();
+            const msg = error instanceof Error ? error.message : String(error);
+            throw new Error(tail ? `${msg}\n--- stderr ---\n${tail}` : msg);
+        }
+    }
+    async [Symbol.asyncDispose]() {
+        const client = this.client;
+        const transport = this.#transport;
+        this.client = null;
+        this.#transport = null;
+        this.#detachStderr?.();
+        this.#detachStderr = null;
+        if (transport) {
+            try {
+                // eslint-disable-next-line unicorn/prefer-add-event-listener -- MCP Transport uses onclose callback, not EventTarget
+                transport.onclose = undefined;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        try {
+            if (client && typeof client.close === "function")
+                await client.close();
+        }
+        catch {
+            /* ignore */
+        }
+        try {
+            if (transport && typeof transport.close === "function")
+                await transport.close();
+        }
+        catch {
+            /* ignore */
+        }
+        this.#stderrRing.clear();
+    }
+}
+//# sourceMappingURL=stdio-driver.js.map

package/dist/providers/mcp/stdio-driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-driver.js","sourceRoot":"","sources":["../../../src/providers/mcp/stdio-driver.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAiC,MAAM,kBAAkB,CAAC;AAChH,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE/E,MAAM,OAAO,wBAAyB,SAAQ,mBAA6C;IACzF,MAAM,CAAU,mBAAmB,GAAG,2BAA2B,CAAC;IAClE,MAAM,CAAU,aAAa,GAAG,gBAAgB,CAAC;IACjD,MAAM,CAAU,kBAAkB,GAAG,WAAW,CAAC;IAE9B,eAAe,CAAC,WAA+B;QAChE,OAAO,IAAI,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,UAAU,GAAgC,IAAI,CAAC;IACtC,WAAW,GAAG,IAAI,UAAU,EAAE,CAAC;IACxC,aAAa,GAAwB,IAAI,CAAC;IAEjC,UAAU;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAEQ,KAAK,CAAC,SAAS;QACtB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,sBAAsB,CAAC;YACjC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAChC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC;YACzC,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAC9D,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG;YACjC,GAAG;YACH,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,MAAyB,CAAC;QACnD,MAAM,YAAY,GAAG,CAAC,KAAsB,EAAQ,EAAE;YACpD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YAC9C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAChC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,GAAG,EAAE;YACxB,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACnF,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;QACtC,qHAAqH;QACrH,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE;YACvB,IAAI,CAAC;gBACH,WAAW,EAAE,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;gBACvB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,IAAI,IAAI,CAAC,aAAa;oBAAE,IAAI,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC,CAAC;QACF,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,wBAAwB,GAAG,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEQ,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,qHAAqH;gBACrH,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU;gBAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,IAAI,CAAC;YACH,IAAI,SAAS,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU;gBAAE,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QAClF,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC"}

package/dist/providers/mcp/stdio-env.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Stdio spawn extras and stderr ring.
+ *
+ * Spawn env: only *extras* go into StdioClientTransport.env — the SDK always
+ * merges getDefaultEnvironment() (PATH/HOME/…). Never { ...process.env }.
+ *
+ * stderr: always "pipe" + ring drain (unread pipe → ~64KiB deadlock).
+ */
+import type { ConnectionSecretsView } from "@inhuman.tools/plexus-expectations/driver";
+export declare class StderrRing {
+    #private;
+    push(chunk: Buffer | string): void;
+    tail(maxLines?: number): string;
+    clear(): void;
+}
+export declare function buildMcpChildEnvExtras(options: {
+    readonly secrets?: Record<string, string>;
+    readonly envForward?: readonly string[];
+    readonly resolveEnv?: (names: readonly string[]) => Record<string, string>;
+}): Record<string, string>;
+/** `env_*` strips the prefix into the child; `token` / `apiKey` uppercase. */
+export declare function secretEnv(secrets: ConnectionSecretsView): Record<string, string>;
+//# sourceMappingURL=stdio-env.d.ts.map

package/dist/providers/mcp/stdio-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-env.d.ts","sourceRoot":"","sources":["../../../src/providers/mcp/stdio-env.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAMvF,qBAAa,UAAU;;IAIrB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAiBlC,IAAI,CAAC,QAAQ,SAAoB,GAAG,MAAM;IAO1C,KAAK,IAAI,IAAI;CAId;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5E,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA8BzB;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWhF"}

package/dist/providers/mcp/stdio-env.js

@@ -0,0 +1,82 @@
+/** Cap ring bytes (diagnostics only — never connection failure). */
+const STDERR_RING_MAX = 64 * 1024;
+const STDERR_TAIL_LINES = 40;
+export class StderrRing {
+    #chunks = [];
+    #bytes = 0;
+    push(chunk) {
+        const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+        if (buf.length === 0)
+            return;
+        this.#chunks.push(buf);
+        this.#bytes += buf.length;
+        while (this.#bytes > STDERR_RING_MAX && this.#chunks.length > 1) {
+            const dropped = this.#chunks.shift();
+            this.#bytes -= dropped.length;
+        }
+        if (this.#bytes > STDERR_RING_MAX && this.#chunks.length === 1) {
+            const only = this.#chunks[0];
+            const keep = only.subarray(only.length - STDERR_RING_MAX);
+            this.#chunks = [Buffer.from(keep)];
+            this.#bytes = keep.length;
+        }
+    }
+    tail(maxLines = STDERR_TAIL_LINES) {
+        const text = Buffer.concat(this.#chunks).toString("utf8");
+        if (text.length === 0)
+            return "";
+        const lines = text.split(/\r?\n/);
+        return lines.slice(-maxLines).join("\n").trimEnd();
+    }
+    clear() {
+        this.#chunks = [];
+        this.#bytes = 0;
+    }
+}
+export function buildMcpChildEnvExtras(options) {
+    const extras = {};
+    const tmp = process.env.TMPDIR ?? process.env.TMP ?? process.env.TEMP;
+    if (typeof tmp === "string" && tmp !== "") {
+        extras.TMPDIR = tmp;
+        if (process.platform === "win32") {
+            extras.TEMP = tmp;
+            extras.TMP = tmp;
+        }
+    }
+    const names = options.envForward ?? [];
+    if (names.length > 0) {
+        const resolved = options.resolveEnv?.(names) ??
+            Object.fromEntries(names.map((n) => {
+                const v = process.env[n];
+                return [n, typeof v === "string" ? v : ""];
+            }));
+        for (const [k, v] of Object.entries(resolved)) {
+            if (v !== "")
+                extras[k] = v;
+        }
+    }
+    if (options.secrets) {
+        for (const [k, v] of Object.entries(options.secrets)) {
+            if (v !== "")
+                extras[k] = v;
+        }
+    }
+    return extras;
+}
+/** `env_*` strips the prefix into the child; `token` / `apiKey` uppercase. */
+export function secretEnv(secrets) {
+    const out = {};
+    const bag = secrets.all?.();
+    if (!bag)
+        return out;
+    for (const [k, v] of Object.entries(bag)) {
+        if (typeof v === "string" && v !== "") {
+            if (k.startsWith("env_"))
+                out[k.slice(4)] = v;
+            else if (k === "token" || k === "apiKey")
+                out[k.toUpperCase()] = v;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=stdio-env.js.map

package/dist/providers/mcp/stdio-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio-env.js","sourceRoot":"","sources":["../../../src/providers/mcp/stdio-env.ts"],"names":[],"mappings":"AAUA,oEAAoE;AACpE,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAClC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,MAAM,OAAO,UAAU;IACrB,OAAO,GAAa,EAAE,CAAC;IACvB,MAAM,GAAG,CAAC,CAAC;IAEX,IAAI,CAAC,KAAsB;QACzB,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACnE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;QAC1B,OAAO,IAAI,CAAC,MAAM,GAAG,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAG,CAAC;YACtC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;QAChC,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;YAC1D,IAAI,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,GAAG,iBAAiB;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClB,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB,CAAC,OAItC;IACC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC;QACpB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC;YAClB,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;QACnB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GACZ,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC;YAC3B,MAAM,CAAC,WAAW,CAChB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACd,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7C,CAAC,CAAC,CACH,CAAC;QACJ,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,EAAE;gBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,EAAE;gBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,SAAS,CAAC,OAA8B;IACtD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;iBACzC,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/providers/mcp/tool-filter.d.ts

@@ -0,0 +1,15 @@
+export declare function mcpGlobMatch(pattern: string, value: string): boolean;
+type ToolRule = {
+    readonly exclude: boolean;
+    readonly pattern: string;
+};
+/** `undefined` = no `tools` field (pass all). Empty array = admit none. */
+export declare function parseMcpToolRules(raw: unknown): readonly string[] | undefined;
+export declare function effectiveMcpToolRules(rules: readonly string[]): readonly ToolRule[];
+export declare function filterMcpToolNames(names: readonly string[], raw: unknown): string[];
+export declare function mcpToolAllowed(raw: unknown, serverToolName: string): boolean;
+export declare function mcpToolsSettingOf(settings: {
+    readonly tools?: unknown;
+} | Record<string, unknown>): unknown;
+export {};
+//# sourceMappingURL=tool-filter.d.ts.map

package/dist/providers/mcp/tool-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-filter.d.ts","sourceRoot":"","sources":["../../../src/providers/mcp/tool-filter.ts"],"names":[],"mappings":"AAQA,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQpE;AAED,KAAK,QAAQ,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAYxE,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,CAI7E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,QAAQ,EAAE,CAWnF;AAcD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAInF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAE3G"}

package/dist/providers/mcp/tool-filter.js

@@ -0,0 +1,75 @@
+/**
+ * Per-server `tools` globs on the connection settings bag.
+ * Missing / malformed = no filter. Empty list = none. Only `!` rules
+ * prepend `*`. Otherwise apply in listed order against `serverToolName`.
+ * Catalog hide is not a license skip — a named call still must not run.
+ */
+const GLOB_SPECIALS = /[.+^${}()|[\]\\]/g;
+export function mcpGlobMatch(pattern, value) {
+    const body = pattern
+        .replaceAll(GLOB_SPECIALS, String.raw `\$&`)
+        .replaceAll("*", ".*")
+        .replaceAll("?", ".");
+    // pattern is operator-authored config, not an untrusted regex.
+    // eslint-disable-next-line security/detect-non-literal-regexp
+    return new RegExp(`^${body}$`).test(value);
+}
+function parseToolRule(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === "" || trimmed === "!")
+        return undefined;
+    if (trimmed.startsWith("!")) {
+        const pattern = trimmed.slice(1).trim();
+        return pattern === "" ? undefined : { exclude: true, pattern };
+    }
+    return { exclude: false, pattern: trimmed };
+}
+/** `undefined` = no `tools` field (pass all). Empty array = admit none. */
+export function parseMcpToolRules(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (!Array.isArray(raw))
+        return undefined;
+    return raw.filter((row) => typeof row === "string");
+}
+export function effectiveMcpToolRules(rules) {
+    const parsed = [];
+    for (const row of rules) {
+        const rule = parseToolRule(row);
+        if (rule !== undefined)
+            parsed.push(rule);
+    }
+    if (parsed.length === 0)
+        return parsed;
+    if (parsed.every((rule) => rule.exclude)) {
+        return [{ exclude: false, pattern: "*" }, ...parsed];
+    }
+    return parsed;
+}
+function applyMcpToolRules(names, rules) {
+    const admitted = new Set();
+    for (const rule of rules) {
+        for (const name of names) {
+            if (!mcpGlobMatch(rule.pattern, name))
+                continue;
+            if (rule.exclude)
+                admitted.delete(name);
+            else
+                admitted.add(name);
+        }
+    }
+    return names.filter((name) => admitted.has(name));
+}
+export function filterMcpToolNames(names, raw) {
+    const rules = parseMcpToolRules(raw);
+    if (rules === undefined)
+        return [...names];
+    return applyMcpToolRules(names, effectiveMcpToolRules(rules));
+}
+export function mcpToolAllowed(raw, serverToolName) {
+    return filterMcpToolNames([serverToolName], raw).includes(serverToolName);
+}
+export function mcpToolsSettingOf(settings) {
+    return "tools" in settings ? settings.tools : undefined;
+}
+//# sourceMappingURL=tool-filter.js.map

package/dist/providers/mcp/tool-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-filter.js","sourceRoot":"","sources":["../../../src/providers/mcp/tool-filter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAa;IACzD,MAAM,IAAI,GAAG,OAAO;SACjB,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC;SAC1C,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC;SACrB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxB,+DAA+D;IAC/D,8DAA8D;IAC9D,OAAO,IAAI,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAID,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACvC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAwB,EAAE,KAA0B;IAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;gBAAE,SAAS;YAChD,IAAI,IAAI,CAAC,OAAO;gBAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;;gBACnC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAwB,EAAE,GAAY;IACvE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IAC3C,OAAO,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAY,EAAE,cAAsB;IACjE,OAAO,kBAAkB,CAAC,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgE;IAChG,OAAO,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC"}

package/dist/providers/mcp/tool-severity.d.ts

@@ -0,0 +1,9 @@
+export declare const MCP_TOOL_SEVERITIES: readonly ["view", "effect", "irreversible-effect"];
+export type McpToolSeverity = (typeof MCP_TOOL_SEVERITIES)[number];
+export declare function parseMcpToolSeverity(raw: unknown): McpToolSeverity | undefined;
+export declare function mcpToolSeverityOf(raw: unknown, serverToolName: string): McpToolSeverity | undefined;
+export declare function mcpCatalogClassOf(serverToolName: string, autoClass: string | undefined, raw: unknown): string;
+export declare function mcpToolSeveritySettingOf(settings: {
+    readonly toolSeverity?: unknown;
+} | Record<string, unknown>): unknown;
+//# sourceMappingURL=tool-severity.d.ts.map

package/dist/providers/mcp/tool-severity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-severity.d.ts","sourceRoot":"","sources":["../../../src/providers/mcp/tool-severity.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,mBAAmB,oDAAqD,CAAC;AACtF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAUnE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAE9E;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAYnG;AAED,wBAAgB,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAI7G;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtE,OAAO,CAET"}

package/dist/providers/mcp/tool-severity.js

@@ -0,0 +1,46 @@
+/**
+ * Per-server `toolSeverity` overlay on the connection settings bag.
+ * Auto-classify (name prefix today) covers the base cases. This map is
+ * the named leftover — last matching key wins. Keys are `serverToolName`
+ * globs. Missing / malformed = no overlay.
+ *
+ * Catalog class mapping: view → read, effect → effect, irreversible-effect → write.
+ * Auto-classify today is only read|write from a name prefix; `effect` is
+ * overlay-only. Classifier / persist must not treat an overlay as a grant.
+ */
+import { mcpGlobMatch } from "./tool-filter.js";
+export const MCP_TOOL_SEVERITIES = ["view", "effect", "irreversible-effect"];
+const SEVERITY = new Set(MCP_TOOL_SEVERITIES);
+const CATALOG_CLASS = {
+    view: "read",
+    effect: "effect",
+    "irreversible-effect": "write",
+};
+export function parseMcpToolSeverity(raw) {
+    return typeof raw === "string" && SEVERITY.has(raw) ? raw : undefined;
+}
+export function mcpToolSeverityOf(raw, serverToolName) {
+    if (raw === undefined || raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        return undefined;
+    }
+    let hit;
+    for (const [key, value] of Object.entries(raw)) {
+        const pattern = key.trim();
+        if (pattern === "" || !mcpGlobMatch(pattern, serverToolName))
+            continue;
+        const severity = parseMcpToolSeverity(value);
+        if (severity !== undefined)
+            hit = severity;
+    }
+    return hit;
+}
+export function mcpCatalogClassOf(serverToolName, autoClass, raw) {
+    const overlay = mcpToolSeverityOf(raw, serverToolName);
+    if (overlay !== undefined)
+        return CATALOG_CLASS[overlay];
+    return autoClass ?? "effect";
+}
+export function mcpToolSeveritySettingOf(settings) {
+    return settings.toolSeverity;
+}
+//# sourceMappingURL=tool-severity.js.map

package/dist/providers/mcp/tool-severity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-severity.js","sourceRoot":"","sources":["../../../src/providers/mcp/tool-severity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,qBAAqB,CAAU,CAAC;AAGtF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,mBAAmB,CAAC,CAAC;AAEtD,MAAM,aAAa,GAAoC;IACrD,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,qBAAqB,EAAE,OAAO;CAC/B,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAuB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAY,EAAE,cAAsB;IACpE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAgC,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;QAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC;YAAE,SAAS;QACvE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS;YAAE,GAAG,GAAG,QAAQ,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,cAAsB,EAAE,SAA6B,EAAE,GAAY;IACnG,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,SAAS,IAAI,QAAQ,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAuE;IAEvE,OAAQ,QAAuC,CAAC,YAAY,CAAC;AAC/D,CAAC"}

package/dist/providers/mcp/wire.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @/providers/mcp/wire — the one door the generic runtime uses into the MCP
+ * provider: pure readers over a connection's `live.tools` and settings. Its
+ * closure holds no driver, SDK client, or OAuth, so importing it does not
+ * load the transport.
+ */
+export { isMcpDriver as isMcpDriver } from "./config.js";
+export { discoverMcpConnectionTools as discoverMcpConnectionTools } from "./discovery.js";
+export { parseListedTools as parseListedTools, type McpListedTool as McpListedTool } from "./schemas/mcp.js";
+export { mcpCatalogClassOf as mcpCatalogClassOf, mcpToolSeveritySettingOf as mcpToolSeveritySettingOf, } from "./tool-severity.js";
+//# sourceMappingURL=wire.d.ts.map

package/dist/providers/mcp/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../../src/providers/mcp/wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,IAAI,WAAW,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,0BAA0B,IAAI,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,IAAI,gBAAgB,EAAE,KAAK,aAAa,IAAI,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EACL,iBAAiB,IAAI,iBAAiB,EACtC,wBAAwB,IAAI,wBAAwB,GACrD,MAAM,oBAAoB,CAAC"}

package/dist/providers/mcp/wire.js

@@ -0,0 +1,11 @@
+/**
+ * @/providers/mcp/wire — the one door the generic runtime uses into the MCP
+ * provider: pure readers over a connection's `live.tools` and settings. Its
+ * closure holds no driver, SDK client, or OAuth, so importing it does not
+ * load the transport.
+ */
+export { isMcpDriver as isMcpDriver } from "./config.js";
+export { discoverMcpConnectionTools as discoverMcpConnectionTools } from "./discovery.js";
+export { parseListedTools as parseListedTools } from "./schemas/mcp.js";
+export { mcpCatalogClassOf as mcpCatalogClassOf, mcpToolSeveritySettingOf as mcpToolSeveritySettingOf, } from "./tool-severity.js";
+//# sourceMappingURL=wire.js.map

package/dist/providers/mcp/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../../src/providers/mcp/wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,IAAI,WAAW,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,0BAA0B,IAAI,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,IAAI,gBAAgB,EAAuC,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EACL,iBAAiB,IAAI,iBAAiB,EACtC,wBAAwB,IAAI,wBAAwB,GACrD,MAAM,oBAAoB,CAAC"}

package/dist/providers/nous/auth.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Nous Portal device-code OAuth (RFC 8628). Hermes CLI's public client
+ * (`hermes-cli`) and `inference:invoke`. Access tokens are bearer JWTs;
+ * refresh uses the Portal token endpoint.
+ * @see https://portal.nousresearch.com/api-docs
+ */
+import { type DeviceAuthorization, type OidcProfile, type OidcTokens } from "../auth/index.js";
+export declare const NOUS_PORTAL_URL = "https://portal.nousresearch.com";
+export declare const NOUS_BASE_URL = "https://inference-api.nousresearch.com/v1";
+export declare const NOUS_CLIENT_ID = "hermes-cli";
+export declare const NOUS_SCOPE = "inference:invoke";
+export declare const NOUS_DEVICE_CODE_URL = "https://portal.nousresearch.com/api/oauth/device/code";
+export declare const NOUS_TOKEN_URL = "https://portal.nousresearch.com/api/oauth/token";
+export declare const NOUS_LOGIN_HINT = "Approve Nous Portal in the browser, then continue";
+export declare const NOUS_OIDC_PROFILE: OidcProfile;
+export type NousDeviceCode = Pick<DeviceAuthorization, "deviceCode" | "verificationUriComplete" | "expiresInSec" | "intervalSec">;
+export declare function requestNousDeviceCode(): Promise<NousDeviceCode>;
+export declare function pollNousDeviceToken(device: NousDeviceCode, signal?: AbortSignal): Promise<OidcTokens>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/providers/nous/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/providers/nous/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAGL,KAAK,mBAAmB,EAExB,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAE1B,eAAO,MAAM,eAAe,oCAAoC,CAAC;AACjE,eAAO,MAAM,aAAa,8CAA8C,CAAC;AACzE,eAAO,MAAM,cAAc,eAAe,CAAC;AAC3C,eAAO,MAAM,UAAU,qBAAqB,CAAC;AAC7C,eAAO,MAAM,oBAAoB,0DAA6C,CAAC;AAC/E,eAAO,MAAM,cAAc,oDAAuC,CAAC;AACnE,eAAO,MAAM,eAAe,sDAAsD,CAAC;AAEnF,eAAO,MAAM,iBAAiB,EAAE,WAU/B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,mBAAmB,EACnB,YAAY,GAAG,yBAAyB,GAAG,cAAc,GAAG,aAAa,CAC1E,CAAC;AAcF,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,cAAc,CAAC,CAQrE;AAED,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAE3G"}

package/dist/providers/nous/auth.js

@@ -0,0 +1,49 @@
+/**
+ * Nous Portal device-code OAuth (RFC 8628). Hermes CLI's public client
+ * (`hermes-cli`) and `inference:invoke`. Access tokens are bearer JWTs;
+ * refresh uses the Portal token endpoint.
+ * @see https://portal.nousresearch.com/api-docs
+ */
+import { pollDeviceToken, requestDeviceCode, } from "../auth/index.js";
+export const NOUS_PORTAL_URL = "https://portal.nousresearch.com";
+export const NOUS_BASE_URL = "https://inference-api.nousresearch.com/v1";
+export const NOUS_CLIENT_ID = "hermes-cli";
+export const NOUS_SCOPE = "inference:invoke";
+export const NOUS_DEVICE_CODE_URL = `${NOUS_PORTAL_URL}/api/oauth/device/code`;
+export const NOUS_TOKEN_URL = `${NOUS_PORTAL_URL}/api/oauth/token`;
+export const NOUS_LOGIN_HINT = "Approve Nous Portal in the browser, then continue";
+export const NOUS_OIDC_PROFILE = {
+    driver: "nous",
+    clientId: NOUS_CLIENT_ID,
+    authorizeUrl: `${NOUS_PORTAL_URL}/oauth/authorize`,
+    tokenUrl: NOUS_TOKEN_URL,
+    userinfoUrl: "",
+    scope: NOUS_SCOPE,
+    extraAuthorize: {},
+    loginHint: NOUS_LOGIN_HINT,
+    baseUrl: NOUS_BASE_URL,
+};
+const NOUS_DEVICE_CLIENT = {
+    driver: "nous",
+    label: "Nous Portal",
+    clientId: NOUS_CLIENT_ID,
+    deviceCodeUrl: NOUS_DEVICE_CODE_URL,
+    tokenUrl: NOUS_TOKEN_URL,
+    scope: NOUS_SCOPE,
+    extraDevice: { source: "device_code" },
+    fallbackVerificationUri: `${NOUS_PORTAL_URL}/manage-subscription`,
+    minIntervalSec: 5,
+};
+export async function requestNousDeviceCode() {
+    const device = await requestDeviceCode(NOUS_DEVICE_CLIENT);
+    return {
+        deviceCode: device.deviceCode,
+        verificationUriComplete: device.verificationUriComplete,
+        expiresInSec: device.expiresInSec,
+        intervalSec: device.intervalSec,
+    };
+}
+export async function pollNousDeviceToken(device, signal) {
+    return pollDeviceToken(NOUS_DEVICE_CLIENT, device, undefined, signal);
+}
+//# sourceMappingURL=auth.js.map

package/dist/providers/nous/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/providers/nous/auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,iBAAiB,GAKlB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,eAAe,GAAG,iCAAiC,CAAC;AACjE,MAAM,CAAC,MAAM,aAAa,GAAG,2CAA2C,CAAC;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,eAAe,wBAAwB,CAAC;AAC/E,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,eAAe,kBAAkB,CAAC;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,mDAAmD,CAAC;AAEnF,MAAM,CAAC,MAAM,iBAAiB,GAAgB;IAC5C,MAAM,EAAE,MAAM;IACd,QAAQ,EAAE,cAAc;IACxB,YAAY,EAAE,GAAG,eAAe,kBAAkB;IAClD,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,EAAE;IACf,KAAK,EAAE,UAAU;IACjB,cAAc,EAAE,EAAE;IAClB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,aAAa;CACvB,CAAC;AAOF,MAAM,kBAAkB,GAAiB;IACvC,MAAM,EAAE,MAAM;IACd,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,oBAAoB;IACnC,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,UAAU;IACjB,WAAW,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;IACtC,uBAAuB,EAAE,GAAG,eAAe,sBAAsB;IACjE,cAAc,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IAC3D,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,uBAAuB,EAAE,MAAM,CAAC,uBAAuB;QACvD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAsB,EAAE,MAAoB;IACpF,OAAO,eAAe,CAAC,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC"}

package/dist/providers/nous/borrow.d.ts

@@ -0,0 +1,3 @@
+export declare function borrowedEnsureKey(internId: string, sourceId: string | null): string;
+export declare function memoBorrowedEnsure<T>(memos: Map<string, Promise<T>>, internId: string, sourceId: string | null, ensureSource: (id: string) => Promise<unknown>, ensureIntern: () => Promise<T>, remintIntern?: () => void | Promise<void>): Promise<T>;
+//# sourceMappingURL=borrow.d.ts.map

package/dist/providers/nous/borrow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"borrow.d.ts","sourceRoot":"","sources":["../../../src/providers/nous/borrow.ts"],"names":[],"mappings":"AAYA,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEnF;AAMD,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAC9B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAC9C,YAAY,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC9B,YAAY,GAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAmB,GACzD,OAAO,CAAC,CAAC,CAAC,CA2BZ"}

package/dist/providers/nous/borrow.js

@@ -0,0 +1,49 @@
+/**
+ * Token owner is the live Nous OIDC connection. Intern honor borrows after
+ * that connection has been ensured. Source failure still mints intern (401,
+ * not hang).
+ *
+ * Memo key is intern + current source so PEW ticks share one chain, while a
+ * source A→B switch cannot reuse A's handshake. Kernel intern is keyed by
+ * connection id only — changing the memo key is not enough; remint drops
+ * the shared lease so the next ensure constructs against B.
+ */
+const SOURCE_SEP = "\u001f";
+export function borrowedEnsureKey(internId, sourceId) {
+    return `${internId}${SOURCE_SEP}${sourceId ?? ""}`;
+}
+function internPrefix(internId) {
+    return `${internId}${SOURCE_SEP}`;
+}
+export function memoBorrowedEnsure(memos, internId, sourceId, ensureSource, ensureIntern, remintIntern = () => undefined) {
+    const key = borrowedEnsureKey(internId, sourceId);
+    const hit = memos.get(key);
+    if (hit !== undefined)
+        return hit;
+    const stale = [];
+    const prefix = internPrefix(internId);
+    for (const [existing, pending] of memos) {
+        if (existing === key || !existing.startsWith(prefix))
+            continue;
+        stale.push(pending);
+        memos.delete(existing);
+    }
+    const pending = (async () => {
+        if (stale.length > 0) {
+            await Promise.allSettled(stale);
+            await remintIntern();
+        }
+        if (sourceId !== null) {
+            try {
+                await ensureSource(sourceId);
+            }
+            catch {
+                /* source handshake failure still mints intern */
+            }
+        }
+        return ensureIntern();
+    })();
+    memos.set(key, pending);
+    return pending;
+}
+//# sourceMappingURL=borrow.js.map

package/dist/providers/nous/borrow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"borrow.js","sourceRoot":"","sources":["../../../src/providers/nous/borrow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,QAAQ,CAAC;AAE5B,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,QAAuB;IACzE,OAAO,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,GAAG,QAAQ,GAAG,UAAU,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAA8B,EAC9B,QAAgB,EAChB,QAAuB,EACvB,YAA8C,EAC9C,YAA8B,EAC9B,eAA2C,GAAG,EAAE,CAAC,SAAS;IAE1D,MAAM,GAAG,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACxC,IAAI,QAAQ,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/D,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,YAAY,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;QACH,CAAC;QACD,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC,CAAC,EAAE,CAAC;IACL,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC"}