@introspection-ai/recipes 0.25.0 → 0.26.0

package/dist/mcp-chunks/{chunk-GQ6NSIDS.js → chunk-Y3L5LWBY.js}

@@ -1,43 +1,69 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  stableJsonStringify
+} from "./chunk-AS27BTCS.js";
 import {
   NON_INTERACTIVE_ELICITATION_HINT,
   createNonInteractiveElicitationResponder,
   registerElicitationHandler
-} from "./chunk-ZOAQDFAO.js";
+} from "./chunk-REEFOL44.js";
 import {
   RecordTransport,
   resolveRecordingPath
-} from "./chunk-OP3IW2V6.js";
+} from "./chunk-AP5VHS73.js";
 import {
   OAuthTimeoutError,
   connectWithAuth,
   createOAuthSession,
   isOAuthFlowError,
   isPostAuthConnectError,
+  isUnauthorizedError,
+  maybeEnableOAuth,
   resolveOAuthTimeoutFromEnv
-} from "./chunk-YIRGLKDA.js";
+} from "./chunk-M62ESEOY.js";
 import {
   readCachedAccessToken
-} from "./chunk-ASG4OY3M.js";
+} from "./chunk-Z6QEOUMK.js";
 import {
-  isUnauthorizedError,
-  maybeEnableOAuth
-} from "./chunk-IRTJXFWA.js";
+  withRuntimeEnvironment
+} from "./chunk-YI5SMRFH.js";
+import {
+  createPrefixedConsoleLogger,
+  resolveLogLevelFromEnv
+} from "./chunk-N7ZWX3WW.js";
 import {
   STDIO_TRACE_ENABLED,
   flushStdioLogs,
   ignoreStdioEmitterError
-} from "./chunk-EMSNQHZZ.js";
+} from "./chunk-TGPIW6F6.js";
 import {
   MCPORTER_VERSION
-} from "./chunk-OD3MSMXY.js";
+} from "./chunk-NTABJCUL.js";
 import {
-  createPrefixedConsoleLogger,
-  resolveLogLevelFromEnv
-} from "./chunk-7WOKCV6Q.js";
+  normalizeTimeout,
+  raceWithTimeout,
+  resolveCommandArgument,
+  resolveCommandArguments
+} from "./chunk-YVH36MGQ.js";
+import {
+  loadServerDefinitions,
+  normalizeServerEntry,
+  parseTree,
+  readConfigFile
+} from "./chunk-J2WP6ERZ.js";
+import {
+  pathExists
+} from "./chunk-G4H535MI.js";
+import {
+  mcporterConfigCandidates
+} from "./chunk-LYWEATXZ.js";
+import {
+  resolveEnvPlaceholders,
+  resolveEnvValue
+} from "./chunk-EP22XMWK.js";
 import {
   analyzeConnectionError
-} from "./chunk-QZUC2T72.js";
+} from "./chunk-GL4AA5QV.js";
 import {
   Client,
   DEFAULT_REQUEST_TIMEOUT_MSEC,
@@ -50,28 +76,7 @@ import {
   StreamableHTTPClientTransport,
   serializeMessage,
   specTypeSchemas
-} from "./chunk-PZ323CXI.js";
-import {
-  ChromeDevtoolsRelayRequiredError,
-  formatChromeDevtoolsRelayDecision,
-  recordChromeDevtoolsRelayDecision,
-  resolveChromeDevtoolsAutoConnectCommand,
-  resolveChromeDevtoolsRelayEnvironment,
-  rewriteChromeDevtoolsArgsForRelay
-} from "./chunk-BWW4XRUC.js";
-import {
-  normalizeTimeout,
-  raceWithTimeout,
-  resolveCommandArgument,
-  resolveCommandArguments
-} from "./chunk-I5GI2A2D.js";
-import {
-  loadServerDefinitions
-} from "./chunk-RD7NHCRK.js";
-import {
-  resolveEnvPlaceholders,
-  withEnvOverrides
-} from "./chunk-WTMJMM3B.js";
+} from "./chunk-CN5YF3IQ.js";
 import {
   __commonJS,
   __require,
@@ -83,8 +88,8 @@ var require_windows = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs5 = __require("fs");
-    function checkPathExt(path4, options) {
+    var fs8 = __require("fs");
+    function checkPathExt(path9, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
         return true;
@@ -95,25 +100,25 @@ var require_windows = __commonJS({
       }
       for (var i = 0; i < pathext.length; i++) {
         var p = pathext[i].toLowerCase();
-        if (p && path4.substr(-p.length).toLowerCase() === p) {
+        if (p && path9.substr(-p.length).toLowerCase() === p) {
           return true;
         }
       }
       return false;
     }
-    function checkStat(stat, path4, options) {
+    function checkStat(stat, path9, options) {
       if (!stat.isSymbolicLink() && !stat.isFile()) {
         return false;
       }
-      return checkPathExt(path4, options);
+      return checkPathExt(path9, options);
     }
-    function isexe(path4, options, cb) {
-      fs5.stat(path4, function(er, stat) {
-        cb(er, er ? false : checkStat(stat, path4, options));
+    function isexe(path9, options, cb) {
+      fs8.stat(path9, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, path9, options));
       });
     }
-    function sync(path4, options) {
-      return checkStat(fs5.statSync(path4), path4, options);
+    function sync(path9, options) {
+      return checkStat(fs8.statSync(path9), path9, options);
     }
   }
 });
@@ -123,14 +128,14 @@ var require_mode = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs5 = __require("fs");
-    function isexe(path4, options, cb) {
-      fs5.stat(path4, function(er, stat) {
+    var fs8 = __require("fs");
+    function isexe(path9, options, cb) {
+      fs8.stat(path9, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
-    function sync(path4, options) {
-      return checkStat(fs5.statSync(path4), options);
+    function sync(path9, options) {
+      return checkStat(fs8.statSync(path9), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -154,7 +159,7 @@ var require_mode = __commonJS({
 // node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
-    var fs5 = __require("fs");
+    var fs8 = __require("fs");
     var core;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core = require_windows();
@@ -163,7 +168,7 @@ var require_isexe = __commonJS({
     }
     module.exports = isexe;
     isexe.sync = sync;
-    function isexe(path4, options, cb) {
+    function isexe(path9, options, cb) {
       if (typeof options === "function") {
         cb = options;
         options = {};
@@ -173,7 +178,7 @@ var require_isexe = __commonJS({
           throw new TypeError("callback not provided");
         }
         return new Promise(function(resolve, reject) {
-          isexe(path4, options || {}, function(er, is) {
+          isexe(path9, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
@@ -182,7 +187,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core(path4, options || {}, function(er, is) {
+      core(path9, options || {}, function(er, is) {
         if (er) {
           if (er.code === "EACCES" || options && options.ignoreErrors) {
             er = null;
@@ -192,9 +197,9 @@ var require_isexe = __commonJS({
         cb(er, is);
       });
     }
-    function sync(path4, options) {
+    function sync(path9, options) {
       try {
-        return core.sync(path4, options || {});
+        return core.sync(path9, options || {});
       } catch (er) {
         if (options && options.ignoreErrors || er.code === "EACCES") {
           return false;
@@ -210,7 +215,7 @@ var require_isexe = __commonJS({
 var require_which = __commonJS({
   "node_modules/.pnpm/which@2.0.2/node_modules/which/which.js"(exports, module) {
     var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
-    var path4 = __require("path");
+    var path9 = __require("path");
     var COLON = isWindows ? ";" : ":";
     var isexe = require_isexe();
     var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
@@ -248,7 +253,7 @@ var require_which = __commonJS({
           return opt.all && found.length ? resolve(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path4.join(pathPart, cmd);
+        const pCmd = path9.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         resolve(subStep(p, i, 0));
       });
@@ -275,7 +280,7 @@ var require_which = __commonJS({
       for (let i = 0; i < pathEnv.length; i++) {
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path4.join(pathPart, cmd);
+        const pCmd = path9.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         for (let j = 0; j < pathExt.length; j++) {
           const cur = p + pathExt[j];
@@ -323,7 +328,7 @@ var require_path_key = __commonJS({
 var require_resolveCommand = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js"(exports, module) {
     "use strict";
-    var path4 = __require("path");
+    var path9 = __require("path");
     var which = require_which();
     var getPathKey = require_path_key();
     function resolveCommandAttempt(parsed, withoutPathExt) {
@@ -341,7 +346,7 @@ var require_resolveCommand = __commonJS({
       try {
         resolved = which.sync(parsed.command, {
           path: env[getPathKey({ env })],
-          pathExt: withoutPathExt ? path4.delimiter : void 0
+          pathExt: withoutPathExt ? path9.delimiter : void 0
         });
       } catch (e) {
       } finally {
@@ -350,7 +355,7 @@ var require_resolveCommand = __commonJS({
         }
       }
       if (resolved) {
-        resolved = path4.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+        resolved = path9.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
       }
       return resolved;
     }
@@ -404,8 +409,8 @@ var require_shebang_command = __commonJS({
       if (!match) {
         return null;
       }
-      const [path4, argument] = match[0].replace(/#! ?/, "").split(" ");
-      const binary = path4.split("/").pop();
+      const [path9, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary = path9.split("/").pop();
       if (binary === "env") {
         return argument;
       }
@@ -418,16 +423,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
     "use strict";
-    var fs5 = __require("fs");
+    var fs8 = __require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs5.openSync(command, "r");
-        fs5.readSync(fd, buffer, 0, size, 0);
-        fs5.closeSync(fd);
+        fd = fs8.openSync(command, "r");
+        fs8.readSync(fd, buffer, 0, size, 0);
+        fs8.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -440,7 +445,7 @@ var require_readShebang = __commonJS({
 var require_parse = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js"(exports, module) {
     "use strict";
-    var path4 = __require("path");
+    var path9 = __require("path");
     var resolveCommand = require_resolveCommand();
     var escape = require_escape();
     var readShebang = require_readShebang();
@@ -465,7 +470,7 @@ var require_parse = __commonJS({
       const needsShell = !isExecutableRegExp.test(commandFile);
       if (parsed.options.forceShell || needsShell) {
         const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
-        parsed.command = path4.normalize(parsed.command);
+        parsed.command = path9.normalize(parsed.command);
         parsed.command = escape.command(parsed.command);
         parsed.args = parsed.args.map((arg) => escape.argument(arg, needsDoubleEscapeMetaChars));
         const shellCommand = [parsed.command].concat(parsed.args).join(" ");
@@ -555,7 +560,7 @@ var require_cross_spawn = __commonJS({
     var cp = __require("child_process");
     var parse = require_parse();
     var enoent = require_enoent();
-    function spawn2(command, args, options) {
+    function spawn3(command, args, options) {
       const parsed = parse(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
@@ -567,178 +572,2651 @@ var require_cross_spawn = __commonJS({
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module.exports = spawn2;
-    module.exports.spawn = spawn2;
+    module.exports = spawn3;
+    module.exports.spawn = spawn3;
     module.exports.sync = spawnSync2;
     module.exports._parse = parse;
     module.exports._enoent = enoent;
   }
 });
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime-process-utils.js
-import { execFile } from "node:child_process";
-async function closeTransportAndWait(logger, transport, options = {}) {
-  const pidBeforeClose = getTransportPid(transport);
-  const targetsBeforeClose = pidBeforeClose ? await collectProcessTreePids(pidBeforeClose) : [];
-  let closeError;
-  let closeSettled = false;
-  const closePromise = (options.close ?? (() => transport.close()))().catch((error) => {
-    closeError = error;
-    if (!options.throwOnCloseError) {
-      logger.warn(`Failed to close transport cleanly: ${error.message}`);
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/daemon/connection-identity.js
+import { createHash as createHash4 } from "node:crypto";
+import fs2 from "node:fs/promises";
+import path3 from "node:path";
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-relay.js
+import { createHash as createHash3 } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path2 from "node:path";
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-command.js
+var AUTO_CONNECT_FLAGS = /* @__PURE__ */ new Set(["--autoConnect", "--auto-connect"]);
+var NEGATED_AUTO_CONNECT_FLAGS = /* @__PURE__ */ new Set(["--no-autoConnect", "--no-auto-connect"]);
+var CONNECTION_VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "--browserUrl",
+  "--browser-url",
+  "--channel",
+  "--executablePath",
+  "--executable-path",
+  "--userDataDir",
+  "--user-data-dir",
+  "--wsEndpoint",
+  "--ws-endpoint",
+  "--wsHeaders",
+  "--ws-headers",
+  "-e",
+  "-u",
+  "-w"
+]);
+var NPX_VALUE_OPTIONS = /* @__PURE__ */ new Set([
+  "--cache",
+  "--package",
+  "--prefix",
+  "--registry",
+  "--userconfig",
+  "--workspace",
+  "-p",
+  "-w"
+]);
+var NPX_COMMAND_STRING_OPTIONS = /* @__PURE__ */ new Set(["--call", "-c"]);
+var NPX_NO_VALUE_OPTIONS = /* @__PURE__ */ new Set(["--ignore-existing", "--no-install", "--quiet", "--silent", "--yes", "-y"]);
+var COMMON_WRAPPERS = /* @__PURE__ */ new Set([
+  "ash",
+  "bash",
+  "csh",
+  "dash",
+  "cmd",
+  "doas",
+  "env",
+  "fish",
+  "ksh",
+  "mksh",
+  "node",
+  "npm",
+  "npx",
+  "bunx",
+  "pnpm",
+  "powershell",
+  "pwsh",
+  "sh",
+  "sudo",
+  "tcsh",
+  "yarn",
+  "zsh"
+]);
+function isChromeDevtoolsToken(token) {
+  const normalized = token.replaceAll("\\", "/").toLowerCase();
+  const basename = normalized.slice(normalized.lastIndexOf("/") + 1);
+  return /^chrome-devtools-mcp(?:@[^/]+)?(?:\.(?:bat|cjs|cmd|exe|js|mjs))?$/u.test(basename) || normalized.includes("/chrome-devtools-mcp/") && /\.(?:bat|cjs|cmd|exe|js|mjs)$/u.test(basename);
+}
+function isAmbiguousChromeDevtoolsAutoConnectCommand(command, args) {
+  if (isChromeDevtoolsToken(command))
+    return false;
+  if (isSupportedPackageLauncher(command)) {
+    const target = findPackageLauncherTarget(args);
+    if (!target)
+      return false;
+    if (target.ambiguous)
+      return true;
+    const nestedTarget = commandBasename(args[target.index] ?? "");
+    return COMMON_WRAPPERS.has(nestedTarget) && containsChromeAutoConnectInvocation(args.slice(target.index + 1));
+  }
+  const launcher = commandBasename(command);
+  if (COMMON_WRAPPERS.has(launcher))
+    return containsChromeAutoConnectInvocation(args);
+  const scopedArgs = args.slice(0, optionTerminator(args));
+  const tokenIndex = scopedArgs.findIndex(isChromeDevtoolsToken);
+  return tokenIndex >= 0 && parseChromeDevtoolsAutoConnectArgs(scopedArgs.slice(tokenIndex + 1)).enabled;
+}
+function resolveChromeDevtoolsAutoConnectCommand(command, args) {
+  const target = resolveChromeDevtoolsTarget(command, args);
+  if (!target)
+    return { enabled: false, withoutAutoConnect: args };
+  const parsed = parseChromeDevtoolsAutoConnectArgs(target.args);
+  return {
+    enabled: parsed.enabled,
+    withoutAutoConnect: [...target.prefix, ...parsed.withoutAutoConnect]
+  };
+}
+function replaceChromeDevtoolsAutoConnectArgs(command, args, replacement) {
+  const target = resolveChromeDevtoolsTarget(command, args);
+  if (!target)
+    return args;
+  const parsed = parseChromeDevtoolsAutoConnectArgs(target.args);
+  const stripped = stripConnectionSelectionArgs(parsed.withoutAutoConnect);
+  const targetArgs = [...stripped.args];
+  targetArgs.splice(stripped.insertionIndex, 0, ...replacement);
+  return [...target.prefix, ...targetArgs];
+}
+function resolveChromeDevtoolsTarget(command, args) {
+  if (isChromeDevtoolsToken(command))
+    return { prefix: [], args };
+  if (!isSupportedPackageLauncher(command))
+    return void 0;
+  const target = findPackageLauncherTarget(args);
+  if (!target || target.ambiguous || !isChromeDevtoolsToken(args[target.index] ?? ""))
+    return void 0;
+  const separatorIndex = target.index + 1;
+  const consumesSeparator = target.consumePostTargetSeparator && args[separatorIndex] === "--";
+  const targetStart = consumesSeparator ? separatorIndex + 1 : separatorIndex;
+  return { prefix: args.slice(0, targetStart), args: args.slice(targetStart) };
+}
+function findPackageLauncherTarget(args) {
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === void 0)
+      continue;
+    if (arg === "--") {
+      return index + 1 < args.length ? { index: index + 1, ambiguous: false, consumePostTargetSeparator: false } : void 0;
     }
-  }).finally(() => {
-    closeSettled = true;
-  });
-  if (pidBeforeClose) {
-    destroyTransportStreams(transport);
-    await ensureProcessTreeTerminated(logger, pidBeforeClose, targetsBeforeClose);
-    if (!closeSettled) {
-      await Promise.race([closePromise, delay(100)]);
+    if (arg.startsWith("--call=")) {
+      const value = arg.slice("--call=".length);
+      return containsInlineChromeAutoConnect([value]) ? { index, ambiguous: true, consumePostTargetSeparator: false } : void 0;
     }
-  } else {
-    await closePromise;
-  }
-  if (closeError && options.throwOnCloseError) {
-    throw closeError;
-  }
-}
-function getTransportPid(transport) {
-  if ("pid" in transport) {
-    const candidate = transport.pid;
-    if (typeof candidate === "number" && candidate > 0) {
-      return candidate;
+    if (NPX_COMMAND_STRING_OPTIONS.has(arg)) {
+      const value = args[index + 1] ?? "";
+      return containsInlineChromeAutoConnect([value]) ? { index: index + 1, ambiguous: true, consumePostTargetSeparator: false } : void 0;
+    }
+    if (NPX_VALUE_OPTIONS.has(arg)) {
+      index += 1;
+      continue;
+    }
+    if (NPX_NO_VALUE_OPTIONS.has(arg) || /^--[^=]+=.+/u.test(arg))
+      continue;
+    if (arg.startsWith("-")) {
+      return {
+        index,
+        ambiguous: containsChromeAutoConnectInvocation(args.slice(index)),
+        consumePostTargetSeparator: false
+      };
     }
+    return { index, ambiguous: false, consumePostTargetSeparator: true };
   }
-  return null;
+  return void 0;
 }
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
+function isSupportedPackageLauncher(command) {
+  const launcher = commandBasename(command);
+  return launcher === "npx" || launcher === "bunx";
 }
-async function ensureProcessTreeTerminated(logger, rootPid, capturedTargets = []) {
-  let targets = uniquePids([...capturedTargets, ...await collectProcessTreePids(rootPid)]);
-  if (targets.length === 0 || await waitForTreeExit(targets, 700)) {
-    return;
-  }
-  await sendSignalToTargets(targets, "SIGTERM");
-  targets = uniquePids([...targets, ...await collectProcessTreePids(rootPid)]);
-  if (await waitForTreeExit(targets, 700)) {
-    return;
-  }
-  targets = uniquePids([...targets, ...await collectProcessTreePids(rootPid)]);
-  await sendSignalToTargets(targets, "SIGKILL");
-  if (await waitForTreeExit(targets, 500)) {
-    return;
-  }
-  logger.warn(`Process tree rooted at pid=${rootPid} did not exit after SIGKILL.`);
+function containsChromeAutoConnectInvocation(args) {
+  const tokenIndex = args.findIndex(isChromeDevtoolsToken);
+  if (tokenIndex >= 0)
+    return parseChromeDevtoolsAutoConnectArgs(args.slice(tokenIndex + 1)).enabled;
+  return containsInlineChromeAutoConnect(args);
 }
-function uniquePids(pids) {
-  return [...new Set(pids.filter((pid) => Number.isInteger(pid) && pid > 0))];
+function containsInlineChromeAutoConnect(args) {
+  const rendered = args.join(" ").toLowerCase();
+  return rendered.includes("chrome-devtools-mcp") && /--(?:auto-connect|autoconnect)(?:=true)?(?:[;'"&|)\]}]|\s|$)/u.test(rendered);
 }
-function destroyTransportStreams(transport) {
-  const candidate = transport;
-  for (const key of ["stdin", "stdout", "stderr"]) {
-    try {
-      const stream = candidate[key];
-      stream?.destroy?.();
-    } catch {
+function commandBasename(command) {
+  const normalized = command.replaceAll("\\", "/").toLowerCase();
+  return normalized.slice(normalized.lastIndexOf("/") + 1).replace(/\.(?:cmd|exe)$/u, "");
+}
+function optionTerminator(args) {
+  const index = args.indexOf("--");
+  return index >= 0 ? index : args.length;
+}
+function stripConnectionSelectionArgs(args) {
+  const result = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === void 0)
+      continue;
+    if (arg === "--") {
+      result.push(...args.slice(index));
+      break;
     }
+    if (CONNECTION_VALUE_FLAGS.has(arg)) {
+      index += 1;
+      continue;
+    }
+    if ([...CONNECTION_VALUE_FLAGS].some((flag) => arg.startsWith(`${flag}=`)))
+      continue;
+    result.push(arg);
   }
+  const terminatorIndex = result.indexOf("--");
+  return { args: result, insertionIndex: terminatorIndex >= 0 ? terminatorIndex : result.length };
 }
-async function sendSignalToTargets(pids, signal) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const pid of pids) {
-    if (seen.has(pid)) {
+function parseChromeDevtoolsAutoConnectArgs(args) {
+  const consumed = /* @__PURE__ */ new Set();
+  let enabled = false;
+  let sawOption = false;
+  let terminatorIndex = args.length;
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === void 0)
+      continue;
+    if (arg === "--") {
+      terminatorIndex = index;
+      break;
+    }
+    if (NEGATED_AUTO_CONNECT_FLAGS.has(arg)) {
+      sawOption = true;
+      enabled = false;
+      consumed.add(index);
       continue;
     }
-    seen.add(pid);
-    sendSignal(pid, signal);
+    let matchedNegatedInline = false;
+    for (const flag of NEGATED_AUTO_CONNECT_FLAGS) {
+      if (!arg.startsWith(`${flag}=`))
+        continue;
+      sawOption = true;
+      enabled = false;
+      consumed.add(index);
+      matchedNegatedInline = true;
+      break;
+    }
+    if (matchedNegatedInline)
+      continue;
+    if (AUTO_CONNECT_FLAGS.has(arg)) {
+      sawOption = true;
+      consumed.add(index);
+      const pairedValue = booleanLiteral(args[index + 1]);
+      if (pairedValue !== void 0) {
+        enabled = pairedValue;
+        consumed.add(index + 1);
+        index += 1;
+      } else {
+        enabled = true;
+      }
+      continue;
+    }
+    for (const flag of AUTO_CONNECT_FLAGS) {
+      if (!arg.startsWith(`${flag}=`))
+        continue;
+      sawOption = true;
+      enabled = arg.slice(flag.length + 1) === "true";
+      consumed.add(index);
+      break;
+    }
   }
+  const withoutAutoConnect = args.filter((_arg, index) => !consumed.has(index));
+  let insertionIndex = 0;
+  for (let index = 0; index < terminatorIndex; index += 1) {
+    if (!consumed.has(index))
+      insertionIndex += 1;
+  }
+  return { enabled: sawOption && enabled, withoutAutoConnect, insertionIndex };
 }
-function sendSignal(pid, signal) {
-  try {
-    process.kill(pid, signal);
-  } catch (error) {
-    if (typeof error === "object" && error && "code" in error && error.code === "ESRCH") {
+function booleanLiteral(value) {
+  if (value === "true")
+    return true;
+  if (value === "false")
+    return false;
+  return void 0;
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-relay-proxy.js
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import http, {} from "node:http";
+var WEBSOCKET_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+async function startChromeDevtoolsRelayProxy(options) {
+  const sockets = /* @__PURE__ */ new Set();
+  const clientAuthorization = `Bearer ${randomBytes(32).toString("base64url")}`;
+  let downstreamAccepted = false;
+  let closed = false;
+  const server = http.createServer((_request, response) => {
+    response.writeHead(404, { Connection: "close", "Content-Length": "0" }).end();
+  });
+  server.on("connection", (socket) => trackSocket(sockets, socket));
+  server.on("upgrade", (request, downstream, head) => {
+    if (closed || downstreamAccepted || !isValidDownstreamUpgrade(request, clientAuthorization) || options.upstream.socket.destroyed) {
+      downstream.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+      return;
+    }
+    downstreamAccepted = true;
+    const key = request.headers["sec-websocket-key"];
+    if (typeof key !== "string") {
+      downstream.destroy();
       return;
     }
+    const accept = createHash("sha1").update(`${key}${WEBSOCKET_GUID}`).digest("base64");
+    downstream.write([
+      "HTTP/1.1 101 Switching Protocols",
+      "Connection: Upgrade",
+      "Upgrade: websocket",
+      `Sec-WebSocket-Accept: ${accept}`,
+      "",
+      ""
+    ].join("\r\n"));
+    if (options.upstream.head.length > 0)
+      downstream.write(options.upstream.head);
+    if (head.length > 0)
+      options.upstream.socket.write(head);
+    options.upstream.socket.once("error", () => downstream.destroy());
+    options.upstream.socket.once("close", () => downstream.destroy());
+    downstream.once("error", () => options.upstream.socket.destroy());
+    downstream.once("close", () => options.upstream.socket.destroy());
+    downstream.pipe(options.upstream.socket).pipe(downstream);
+    server.close();
+  });
+  const onUpstreamClose = () => {
+    void closeServer(server, sockets);
+  };
+  options.upstream.socket.once("close", onUpstreamClose);
+  try {
+    await new Promise((resolve, reject) => {
+      const onError = (error) => reject(error);
+      server.once("error", onError);
+      server.listen(0, "127.0.0.1", () => {
+        server.off("error", onError);
+        resolve();
+      });
+    });
+  } catch (error) {
+    closeUpstream(options.upstream.socket);
     throw error;
   }
+  const address = server.address();
+  if (!address || address.address !== "127.0.0.1") {
+    closeUpstream(options.upstream.socket);
+    server.close();
+    throw new Error("Chrome relay proxy failed to bind to IPv4 loopback.");
+  }
+  let authorizationAvailable = true;
+  return {
+    endpoint: `ws://127.0.0.1:${address.port}/cdp`,
+    consumeClientAuthorization() {
+      if (!authorizationAvailable)
+        throw new Error("Chrome relay authorization handoff already consumed.");
+      authorizationAvailable = false;
+      return clientAuthorization;
+    },
+    async close() {
+      if (closed)
+        return;
+      closed = true;
+      options.upstream.socket.off("close", onUpstreamClose);
+      closeUpstream(options.upstream.socket);
+      await closeServer(server, sockets);
+    }
+  };
 }
-async function listDescendantPids(rootPid) {
-  if (!isProcessAlive(rootPid)) {
-    return [];
+function isValidDownstreamUpgrade(request, expectedAuthorization) {
+  if (request.url !== "/cdp" || request.method !== "GET" || request.headers.upgrade?.toLowerCase() !== "websocket" || !hasToken(request.headers.connection, "upgrade") || request.headers["sec-websocket-version"] !== "13" || countRawHeader(request, "authorization") !== 1 || countRawHeader(request, "sec-websocket-key") !== 1 || !safeHeaderEqual(request.headers.authorization, expectedAuthorization)) {
+    return false;
   }
-  if (process.platform === "win32") {
-    return listDescendantPidsWindows(rootPid);
+  const key = request.headers["sec-websocket-key"];
+  if (typeof key !== "string" || !/^[A-Za-z0-9+/]{22}==$/u.test(key))
+    return false;
+  const decoded = Buffer.from(key, "base64");
+  return decoded.byteLength === 16 && decoded.toString("base64") === key;
+}
+function countRawHeader(request, expectedName) {
+  let count = 0;
+  for (let index = 0; index < request.rawHeaders.length; index += 2) {
+    if (request.rawHeaders[index]?.toLowerCase() === expectedName)
+      count += 1;
+  }
+  return count;
+}
+function safeHeaderEqual(actual, expected) {
+  if (!actual)
+    return false;
+  const actualBytes = Buffer.from(actual);
+  const expectedBytes = Buffer.from(expected);
+  return actualBytes.length === expectedBytes.length && timingSafeEqual(actualBytes, expectedBytes);
+}
+function hasToken(value, expected) {
+  return Boolean(value?.split(",").some((token) => token.trim().toLowerCase() === expected));
+}
+function trackSocket(sockets, socket) {
+  if (sockets.has(socket))
+    return;
+  sockets.add(socket);
+  socket.once("close", () => sockets.delete(socket));
+}
+function closeUpstream(socket) {
+  if (socket.destroyed)
+    return;
+  if (!socket.remoteAddress) {
+    socket.destroy();
+    return;
   }
   try {
-    const { stdout } = await execFileAsync("ps", ["-eo", "pid=,ppid="]);
-    const children = /* @__PURE__ */ new Map();
-    for (const line of stdout.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed) {
-        continue;
-      }
-      const [pidText, ppidText] = trimmed.split(/\s+/, 2);
-      const pid = Number.parseInt(pidText ?? "", 10);
-      const ppid = Number.parseInt(ppidText ?? "", 10);
-      if (!Number.isFinite(pid) || !Number.isFinite(ppid)) {
-        continue;
-      }
-      const bucket = children.get(ppid) ?? [];
-      bucket.push(pid);
-      children.set(ppid, bucket);
-    }
-    return collectDescendantsFromChildren(rootPid, children);
+    socket.resetAndDestroy();
   } catch {
-    return [];
+    socket.destroy();
   }
 }
-async function listDescendantPidsWindows(rootPid) {
-  try {
-    const powershellScript = "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId | ConvertTo-Json -Compress";
-    const { stdout } = await execFileAsync("powershell.exe", ["-NoProfile", "-Command", powershellScript]);
-    const trimmed = stdout.trim();
-    if (!trimmed) {
-      return [];
-    }
-    const parsed = JSON.parse(trimmed);
-    const entries = Array.isArray(parsed) ? parsed : [parsed];
-    const children = /* @__PURE__ */ new Map();
-    for (const entry of entries) {
-      const pidCandidate = entry?.ProcessId;
-      const ppidCandidate = entry?.ParentProcessId;
-      if (typeof pidCandidate !== "number" || typeof ppidCandidate !== "number") {
-        continue;
-      }
-      const pid = Number.isFinite(pidCandidate) ? pidCandidate : void 0;
-      const ppid = Number.isFinite(ppidCandidate) ? ppidCandidate : void 0;
-      if (pid === void 0 || ppid === void 0) {
-        continue;
-      }
-      const bucket = children.get(ppid) ?? [];
-      bucket.push(pid);
-      children.set(ppid, bucket);
+async function closeServer(server, sockets) {
+  for (const socket of sockets)
+    socket.destroy();
+  if (!server.listening)
+    return;
+  await new Promise((resolve) => server.close(() => resolve()));
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/browser-relay-auth-v2.js
+import { createHmac, hash, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var BROWSER_RELAY_AUTH_LABEL = "openclaw.browser-relay.auth";
+var BROWSER_RELAY_AUTH_VERSION = 2;
+var BROWSER_RELAY_CHALLENGE_MAX_LIFETIME_MS = 1e4;
+var BROWSER_RELAY_CLOCK_SKEW_MS = 3e4;
+var BROWSER_RELAY_AUTH_CHALLENGE_PATH = "/_openclaw/relay/auth/v2/challenge";
+var BROWSER_RELAY_AUTH_COMPLETE_PATH = "/_openclaw/relay/auth/v2/complete";
+var BROWSER_RELAY_CDP_PATH = "/cdp";
+var BROWSER_RELAY_CDP_ROLE = "cdp";
+var BROWSER_RELAY_CDP_TRANSPORT = "connection";
+var BROWSER_RELAY_CDP_METHOD = "SEQUENCE";
+var BROWSER_RELAY_CDP_RESOURCE = "/json/version -> /cdp";
+var BROWSER_RELAY_CDP_FLOW = "cdp";
+var BROWSER_RELAY_VERSION_PATH = "/json/version";
+function deriveBrowserRelayKeyId(key) {
+  assertRelayKey(key);
+  return hash("sha256", key, "base64url").slice(0, 22);
+}
+function canonicalizeBrowserRelayProof(proofKind, fields, clientProof) {
+  const canonical = [
+    BROWSER_RELAY_AUTH_LABEL,
+    BROWSER_RELAY_AUTH_VERSION,
+    proofKind,
+    fields.keyId,
+    fields.instanceId,
+    fields.sessionId,
+    fields.clientNonce,
+    fields.serverNonce,
+    fields.issuedAtMs,
+    fields.expiresAtMs,
+    fields.role,
+    fields.transport,
+    fields.method,
+    fields.resource,
+    fields.flow
+  ];
+  if (proofKind === "accept") {
+    if (!clientProof || !isCanonicalBase64Url(clientProof, 32)) {
+      throw new Error("Browser relay accept proof requires a 32-byte client proof.");
     }
-    return collectDescendantsFromChildren(rootPid, children);
-  } catch {
-    return [];
+    canonical.push(clientProof);
+  } else if (clientProof !== void 0) {
+    throw new Error("Browser relay client proof is only valid for an accept proof.");
   }
+  return Buffer.from(JSON.stringify(canonical), "utf8");
 }
-function execFileAsync(command, args) {
-  return new Promise((resolve, reject) => {
-    execFile(command, args, { encoding: "utf8" }, (error, stdout, stderr) => {
-      if (error) {
+function createBrowserRelayProof(key, proofKind, fields, clientProof) {
+  assertRelayKey(key);
+  return createHmac("sha256", key).update(canonicalizeBrowserRelayProof(proofKind, fields, clientProof)).digest("base64url");
+}
+function verifyBrowserRelayProof(key, proofKind, fields, proof, clientProof) {
+  if (!isCanonicalBase64Url(proof, 32))
+    return false;
+  const actual = Buffer.from(proof, "base64url");
+  const expected = Buffer.from(createBrowserRelayProof(key, proofKind, fields, clientProof), "base64url");
+  return actual.byteLength === expected.byteLength && timingSafeEqual2(actual, expected);
+}
+function assertRelayKey(key) {
+  if (key.byteLength !== 32)
+    throw new Error("Browser relay key must contain 32 bytes.");
+}
+function isCanonicalBase64Url(value, bytes) {
+  if (!/^[A-Za-z0-9_-]+$/u.test(value))
+    return false;
+  const decoded = Buffer.from(value, "base64url");
+  return decoded.byteLength === bytes && decoded.toString("base64url") === value;
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-relay-client.js
+import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
+import { lookup } from "node:dns/promises";
+import net from "node:net";
+import { TextDecoder } from "node:util";
+var MAX_HEADER_BYTES = 16 * 1024;
+var MAX_JSON_BYTES = 64 * 1024;
+var WEBSOCKET_GUID2 = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+var RelayV2Error = class extends Error {
+  reason;
+  status;
+  constructor(reason, status) {
+    super(`Chrome relay authentication failed (${reason}).`);
+    this.reason = reason;
+    this.status = status;
+    this.name = "RelayV2Error";
+  }
+};
+async function connectChromeDevtoolsRelayV2(options) {
+  const startedAt = performance.now();
+  const durationMs = () => Math.max(0, Math.round(performance.now() - startedAt));
+  let socket;
+  let timer;
+  try {
+    let timedOut = false;
+    const timeout = new Promise((_resolve, reject) => {
+      timer = setTimeout(() => {
+        timedOut = true;
+        const error = new RelayV2Error("timeout");
+        socket?.destroy(error);
         reject(error);
-        return;
+      }, options.timeoutMs);
+    });
+    timer?.unref();
+    const addresses = await Promise.race([
+      resolveLoopbackAddresses(options.baseUrl.hostname, options.resolve ?? lookup),
+      timeout
+    ]);
+    const port = resolvePort(options.baseUrl);
+    let lastConnectionError;
+    for (const address of addresses) {
+      socket = net.createConnection({ host: address.address, family: address.family, port });
+      try {
+        await waitForConnect(socket);
+        lastConnectionError = void 0;
+        break;
+      } catch (error) {
+        socket.destroy();
+        if (timedOut || isTimeoutError(error))
+          throw new RelayV2Error("timeout");
+        lastConnectionError = error;
       }
-      resolve({ stdout, stderr });
+    }
+    if (lastConnectionError)
+      throw lastConnectionError;
+    if (!socket || socket.destroyed)
+      throw new RelayV2Error(timedOut ? "timeout" : "network-error");
+    if (!socket.remoteAddress || !isNumericLoopback(socket.remoteAddress))
+      throw new RelayV2Error("protocol");
+    const reader = new SocketReader(socket);
+    const flow = options.flow ?? "cdp";
+    const clientNonce = randomBytes2(32).toString("base64url");
+    const hello = {
+      v: BROWSER_RELAY_AUTH_VERSION,
+      keyId: options.credential.keyId,
+      clientNonce,
+      role: BROWSER_RELAY_CDP_ROLE,
+      transport: BROWSER_RELAY_CDP_TRANSPORT,
+      method: flow === BROWSER_RELAY_CDP_FLOW ? BROWSER_RELAY_CDP_METHOD : "GET",
+      resource: flow === BROWSER_RELAY_CDP_FLOW ? BROWSER_RELAY_CDP_RESOURCE : "/json/list",
+      flow
+    };
+    await writeJsonRequest(socket, options.baseUrl.host, BROWSER_RELAY_AUTH_CHALLENGE_PATH, hello);
+    const challengeResponse = await reader.readHttpResponse(MAX_JSON_BYTES);
+    ensureAuthStatus(challengeResponse, "challenge");
+    const challenge = parseStrictJsonObject(challengeResponse.body);
+    const fields = validateChallenge(challenge, hello, options.now?.() ?? Date.now());
+    const serverProof = requireString(challenge, "serverProof");
+    if (!verifyBrowserRelayProof(options.credential.key, "server", fields, serverProof)) {
+      throw new RelayV2Error("bad-server-proof");
+    }
+    const clientProof = createBrowserRelayProof(options.credential.key, "client", fields);
+    await writeJsonRequest(socket, options.baseUrl.host, BROWSER_RELAY_AUTH_COMPLETE_PATH, {
+      v: BROWSER_RELAY_AUTH_VERSION,
+      sessionId: fields.sessionId,
+      clientProof
+    });
+    const completeResponse = await reader.readHttpResponse(MAX_JSON_BYTES);
+    ensureAuthStatus(completeResponse, "complete");
+    const accepted = parseStrictJsonObject(completeResponse.body);
+    validateAccept(accepted, fields.sessionId);
+    if (!verifyBrowserRelayProof(options.credential.key, "accept", fields, requireString(accepted, "acceptProof"), clientProof)) {
+      throw new RelayV2Error("bad-server-proof");
+    }
+    if (flow === "json-list") {
+      await writeRequest(socket, options.baseUrl.host, "GET", "/json/list", []);
+      const listResponse = await reader.readHttpResponse(MAX_JSON_BYTES, true);
+      if (listResponse.status !== 200)
+        throw classifyStatus(listResponse.status, true);
+      const json = parseStrictJson(listResponse.body);
+      if (!Array.isArray(json))
+        throw new RelayV2Error("protocol", 200);
+      socket.destroy();
+      return { reason: "success", durationMs: durationMs(), status: 200, json };
+    }
+    await writeRequest(socket, options.baseUrl.host, "GET", BROWSER_RELAY_VERSION_PATH, []);
+    const versionResponse = await reader.readHttpResponse(MAX_JSON_BYTES);
+    if (versionResponse.status === 503) {
+      socket.destroy();
+      return { reason: "extension-disconnected", durationMs: durationMs(), status: 503 };
+    }
+    if (versionResponse.status !== 200)
+      throw classifyStatus(versionResponse.status, true);
+    parseStrictJsonObject(versionResponse.body);
+    const websocketKey = randomBytes2(16).toString("base64");
+    await writeRequest(socket, options.baseUrl.host, "GET", BROWSER_RELAY_CDP_PATH, [
+      ["Connection", "Upgrade"],
+      ["Upgrade", "websocket"],
+      ["Sec-WebSocket-Key", websocketKey],
+      ["Sec-WebSocket-Version", "13"]
+    ]);
+    const upgrade = await reader.readHttpUpgrade();
+    if (upgrade.status !== 101)
+      throw classifyStatus(upgrade.status, true);
+    const expectedAccept = createHash2("sha1").update(`${websocketKey}${WEBSOCKET_GUID2}`).digest("base64");
+    if (upgrade.headers.get("upgrade")?.toLowerCase() !== "websocket" || !hasToken2(upgrade.headers.get("connection"), "upgrade") || upgrade.headers.get("sec-websocket-accept") !== expectedAccept) {
+      throw new RelayV2Error("sequence", 101);
+    }
+    const head = reader.release();
+    if (timer)
+      clearTimeout(timer);
+    return { reason: "success", durationMs: durationMs(), status: 200, upstream: { socket, head } };
+  } catch (error) {
+    socket?.destroy();
+    if (error instanceof RelayV2Error) {
+      return { reason: error.reason, durationMs: durationMs(), status: error.status };
+    }
+    return { reason: isTimeoutError(error) ? "timeout" : "network-error", durationMs: durationMs() };
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+async function resolveLoopbackAddresses(hostname, resolver) {
+  const normalized = hostname.replace(/^\[(.*)\]$/u, "$1");
+  const addresses = await resolver(normalized, { all: true, verbatim: true });
+  if (addresses.length === 0 || addresses.some((address) => !isNumericLoopback(address.address))) {
+    throw new RelayV2Error("protocol");
+  }
+  return addresses;
+}
+function resolvePort(url) {
+  const port = url.port === "" ? 80 : Number(url.port);
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535)
+    throw new RelayV2Error("protocol");
+  return port;
+}
+function isNumericLoopback(address) {
+  if (net.isIPv4(address))
+    return address.startsWith("127.");
+  if (!net.isIPv6(address))
+    return false;
+  const normalized = address.toLowerCase();
+  return normalized === "::1" || normalized.startsWith("::ffff:127.");
+}
+async function waitForConnect(socket) {
+  await new Promise((resolve, reject) => {
+    const onConnect = () => {
+      cleanup();
+      resolve();
+    };
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const cleanup = () => {
+      socket.off("connect", onConnect);
+      socket.off("error", onError);
+    };
+    socket.once("connect", onConnect);
+    socket.once("error", onError);
+  });
+}
+var SocketReader = class {
+  socket;
+  buffered = Buffer.alloc(0);
+  failure;
+  ended = false;
+  onData = (chunk) => {
+    this.buffered = Buffer.concat([this.buffered, chunk]);
+  };
+  onError = (error) => {
+    this.failure = error;
+  };
+  onClose = () => {
+    this.ended = true;
+  };
+  constructor(socket) {
+    this.socket = socket;
+    socket.on("data", this.onData);
+    socket.on("error", this.onError);
+    socket.on("close", this.onClose);
+  }
+  async readHttpResponse(maxBodyBytes, allowConnectionClose = false) {
+    const parsed = await this.readHeaders();
+    if (parsed.status === 101)
+      throw new RelayV2Error("protocol", 101);
+    if (parsed.headers.has("transfer-encoding"))
+      throw new RelayV2Error("protocol", parsed.status);
+    if (!allowConnectionClose && parsed.status === 200 && hasToken2(parsed.headers.get("connection"), "close")) {
+      throw new RelayV2Error("protocol", parsed.status);
+    }
+    const rawLength = parsed.headers.get("content-length");
+    if (!rawLength || !/^\d+$/u.test(rawLength))
+      throw new RelayV2Error("protocol", parsed.status);
+    const length = Number(rawLength);
+    if (!Number.isSafeInteger(length) || length > maxBodyBytes)
+      throw new RelayV2Error("protocol", parsed.status);
+    await this.waitForBytes(length);
+    const body = this.buffered.subarray(0, length);
+    this.buffered = this.buffered.subarray(length);
+    if (this.buffered.length > 0)
+      throw new RelayV2Error("protocol", parsed.status);
+    return { ...parsed, body };
+  }
+  async readHttpUpgrade() {
+    const parsed = await this.readHeaders();
+    if (parsed.headers.has("transfer-encoding"))
+      throw new RelayV2Error("protocol", parsed.status);
+    if (parsed.status === 101) {
+      if (parsed.headers.has("content-length"))
+        throw new RelayV2Error("protocol", parsed.status);
+      return { ...parsed, body: Buffer.alloc(0) };
+    }
+    const rawLength = parsed.headers.get("content-length");
+    if (!rawLength || !/^\d+$/u.test(rawLength))
+      throw new RelayV2Error("protocol", parsed.status);
+    const length = Number(rawLength);
+    if (!Number.isSafeInteger(length) || length > MAX_JSON_BYTES)
+      throw new RelayV2Error("protocol", parsed.status);
+    await this.waitForBytes(length);
+    const body = this.buffered.subarray(0, length);
+    this.buffered = this.buffered.subarray(length);
+    if (this.buffered.length > 0)
+      throw new RelayV2Error("protocol", parsed.status);
+    return { ...parsed, body };
+  }
+  release() {
+    this.socket.off("data", this.onData);
+    this.socket.off("error", this.onError);
+    this.socket.off("close", this.onClose);
+    const head = this.buffered;
+    this.buffered = Buffer.alloc(0);
+    return head;
+  }
+  async readHeaders() {
+    let boundary = this.buffered.indexOf("\r\n\r\n");
+    while (boundary < 0) {
+      if (this.buffered.length > MAX_HEADER_BYTES)
+        throw new RelayV2Error("protocol");
+      await this.waitForData();
+      boundary = this.buffered.indexOf("\r\n\r\n");
+    }
+    if (boundary > MAX_HEADER_BYTES)
+      throw new RelayV2Error("protocol");
+    const raw = this.buffered.subarray(0, boundary).toString("latin1");
+    this.buffered = this.buffered.subarray(boundary + 4);
+    const lines = raw.split("\r\n");
+    const statusLine = lines.shift();
+    const match = /^HTTP\/1\.1 ([1-5]\d\d)(?: [\x20-\x7e]*)?$/u.exec(statusLine ?? "");
+    if (!match)
+      throw new RelayV2Error("protocol");
+    const status = Number(match[1]);
+    const headers = /* @__PURE__ */ new Map();
+    for (const line of lines) {
+      if (/^[ \t]/u.test(line))
+        throw new RelayV2Error("protocol", status);
+      const separator = line.indexOf(":");
+      if (separator <= 0)
+        throw new RelayV2Error("protocol", status);
+      const name = line.slice(0, separator).toLowerCase();
+      const value = line.slice(separator + 1).trim();
+      if (!/^[!#$%&'*+.^_`|~0-9a-z-]+$/u.test(name) || value.includes("\0") || value.includes("\r") || value.includes("\n") || value.includes("\x7F")) {
+        throw new RelayV2Error("protocol", status);
+      }
+      if (headers.has(name))
+        throw new RelayV2Error("protocol", status);
+      headers.set(name, value);
+    }
+    return { status, headers };
+  }
+  async waitForBytes(length) {
+    while (this.buffered.length < length)
+      await this.waitForData();
+  }
+  async waitForData() {
+    if (this.failure)
+      throw this.failure;
+    if (this.ended)
+      throw new RelayV2Error("network-error");
+    await new Promise((resolve, reject) => {
+      const onData = () => {
+        cleanup();
+        resolve();
+      };
+      const onError = (error) => {
+        cleanup();
+        reject(error);
+      };
+      const onClose = () => {
+        cleanup();
+        reject(new RelayV2Error("network-error"));
+      };
+      const cleanup = () => {
+        this.socket.off("data", onData);
+        this.socket.off("error", onError);
+        this.socket.off("close", onClose);
+      };
+      this.socket.once("data", onData);
+      this.socket.once("error", onError);
+      this.socket.once("close", onClose);
+    });
+  }
+};
+async function writeJsonRequest(socket, host, pathname, body) {
+  const encoded = Buffer.from(JSON.stringify(body), "utf8");
+  await writeRequest(socket, host, "POST", pathname, [
+    ["Content-Type", "application/json"],
+    ["Content-Length", String(encoded.byteLength)]
+  ], encoded);
+}
+async function writeRequest(socket, host, method, pathname, headers, body) {
+  const lines = [`${method} ${pathname} HTTP/1.1`, `Host: ${host}`, "Connection: keep-alive"];
+  for (const [name, value] of headers) {
+    if (name.toLowerCase() === "connection")
+      lines[2] = `${name}: ${value}`;
+    else
+      lines.push(`${name}: ${value}`);
+  }
+  const head = Buffer.from(`${lines.join("\r\n")}\r
+\r
+`, "ascii");
+  const output = body ? Buffer.concat([head, body]) : head;
+  await new Promise((resolve, reject) => {
+    socket.write(output, (error) => error ? reject(error) : resolve());
+  });
+}
+function ensureAuthStatus(response, phase) {
+  if (response.status === 200)
+    return;
+  if (phase === "challenge" && response.status === 401 && responseError(response) === "Relay auth challenge rejected") {
+    throw new RelayV2Error("replay", response.status);
+  }
+  if (response.status === 409)
+    throw new RelayV2Error("sequence", response.status);
+  throw classifyStatus(response.status, false);
+}
+function classifyStatus(status, authenticated) {
+  if (!authenticated && (status === 401 || status === 404 || status === 426)) {
+    return new RelayV2Error("unsupported-auth", status);
+  }
+  if (!authenticated && status === 503)
+    return new RelayV2Error("server-auth-failed", status);
+  if (status === 408 || status === 410)
+    return new RelayV2Error("freshness", status);
+  if (status === 409)
+    return new RelayV2Error("sequence", status);
+  if (status === 412)
+    return new RelayV2Error("sequence", status);
+  return new RelayV2Error("protocol", status);
+}
+function responseError(response) {
+  try {
+    const value = parseStrictJsonObject(response.body);
+    return typeof value.error === "string" ? value.error : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function validateChallenge(value, hello, nowMs) {
+  assertExactKeys(value, [
+    "type",
+    "v",
+    "keyId",
+    "instanceId",
+    "sessionId",
+    "clientNonce",
+    "serverNonce",
+    "issuedAtMs",
+    "expiresAtMs",
+    "role",
+    "transport",
+    "method",
+    "resource",
+    "flow",
+    "serverProof"
+  ]);
+  if (value.type !== "auth.challenge")
+    throw new RelayV2Error("protocol");
+  if (value.v !== BROWSER_RELAY_AUTH_VERSION)
+    throw new RelayV2Error("protocol");
+  for (const key of ["keyId", "clientNonce", "role", "transport", "method", "resource", "flow"]) {
+    if (value[key] !== hello[key])
+      throw new RelayV2Error("protocol");
+  }
+  const fields = {
+    keyId: requireToken(value, "keyId", 22),
+    instanceId: requireEncoded(value, "instanceId", 22),
+    sessionId: requireEncoded(value, "sessionId", 22),
+    clientNonce: requireEncoded(value, "clientNonce", 43),
+    serverNonce: requireEncoded(value, "serverNonce", 43),
+    issuedAtMs: requireInteger(value, "issuedAtMs"),
+    expiresAtMs: requireInteger(value, "expiresAtMs"),
+    role: requireString(value, "role"),
+    transport: requireString(value, "transport"),
+    method: requireString(value, "method"),
+    resource: requireString(value, "resource"),
+    flow: requireString(value, "flow")
+  };
+  requireEncoded(value, "serverProof", 43);
+  const lifetime = fields.expiresAtMs - fields.issuedAtMs;
+  if (lifetime <= 0 || lifetime > BROWSER_RELAY_CHALLENGE_MAX_LIFETIME_MS || fields.issuedAtMs - nowMs > BROWSER_RELAY_CLOCK_SKEW_MS || nowMs > fields.expiresAtMs) {
+    throw new RelayV2Error("freshness");
+  }
+  return fields;
+}
+function validateAccept(value, sessionId) {
+  assertExactKeys(value, ["type", "v", "sessionId", "acceptProof"]);
+  if (value.type !== "auth.ok")
+    throw new RelayV2Error("protocol");
+  if (value.v !== BROWSER_RELAY_AUTH_VERSION || value.sessionId !== sessionId)
+    throw new RelayV2Error("protocol");
+  requireEncoded(value, "acceptProof", 43);
+}
+function parseStrictJsonObject(body) {
+  const value = parseStrictJson(body);
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new RelayV2Error("protocol");
+  return value;
+}
+function parseStrictJson(body) {
+  let source;
+  try {
+    source = new TextDecoder("utf-8", { fatal: true }).decode(body);
+  } catch {
+    throw new RelayV2Error("protocol");
+  }
+  const errors = [];
+  const tree = parseTree(source, errors, { allowTrailingComma: false, disallowComments: true });
+  if (!tree || errors.length > 0)
+    throw new RelayV2Error("protocol");
+  rejectDuplicateJsonKeys(tree);
+  try {
+    return JSON.parse(source);
+  } catch {
+    throw new RelayV2Error("protocol");
+  }
+}
+function rejectDuplicateJsonKeys(node) {
+  if (node.type === "object") {
+    const keys = /* @__PURE__ */ new Set();
+    for (const property of node.children ?? []) {
+      const key = property.children?.[0]?.value;
+      if (typeof key !== "string" || keys.has(key))
+        throw new RelayV2Error("protocol");
+      keys.add(key);
+    }
+  }
+  for (const child of node.children ?? [])
+    rejectDuplicateJsonKeys(child);
+}
+function assertExactKeys(value, required) {
+  const actual = Object.keys(value);
+  if (actual.length !== required.length || required.some((key) => !Object.hasOwn(value, key))) {
+    throw new RelayV2Error("protocol");
+  }
+}
+function requireString(value, key) {
+  const field = value[key];
+  if (typeof field !== "string")
+    throw new RelayV2Error("protocol");
+  return field;
+}
+function requireEncoded(value, key, length) {
+  const field = requireString(value, key);
+  const bytes = length === 22 ? 16 : length === 43 ? 32 : 0;
+  const decoded = Buffer.from(field, "base64url");
+  if (bytes === 0 || field.length !== length || !/^[A-Za-z0-9_-]+$/u.test(field) || decoded.byteLength !== bytes || decoded.toString("base64url") !== field) {
+    throw new RelayV2Error("protocol");
+  }
+  return field;
+}
+function requireToken(value, key, length) {
+  const field = requireString(value, key);
+  if (field.length !== length || !/^[A-Za-z0-9_-]+$/u.test(field))
+    throw new RelayV2Error("protocol");
+  return field;
+}
+function requireInteger(value, key) {
+  const field = value[key];
+  if (typeof field !== "number" || !Number.isSafeInteger(field))
+    throw new RelayV2Error("protocol");
+  return field;
+}
+function hasToken2(value, expected) {
+  return Boolean(value?.split(",").some((token) => token.trim().toLowerCase() === expected));
+}
+function isTimeoutError(error) {
+  return Boolean(error && typeof error === "object" && error.reason === "timeout");
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-relay-discovery.js
+import { spawn } from "node:child_process";
+import { statSync } from "node:fs";
+import net2 from "node:net";
+import path from "node:path";
+var OPENCLAW_CDP_ARGS = ["browser", "extension", "cdp", "--json"];
+var OPENCLAW_WINDOWS_COMMAND_SUFFIX = "browser extension cdp --json";
+var OPENCLAW_WINDOWS_DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD";
+var OPENCLAW_WINDOWS_TREE_KILL_TIMEOUT_MS = 1e3;
+var OPENCLAW_PROFILE_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+var OPENCLAW_RELAY_DISCOVERY_MAX_OUTPUT_BYTES = 64 * 1024;
+var OPENCLAW_RELAY_DISCOVERY_ENV_KEYS = [
+  "APPDATA",
+  "COMSPEC",
+  "ComSpec",
+  "HOME",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "LANG",
+  "LC_ALL",
+  "LOCALAPPDATA",
+  "OPENCLAW_CONFIG_PATH",
+  "OPENCLAW_GATEWAY_PORT",
+  "OPENCLAW_HOME",
+  "OPENCLAW_OAUTH_DIR",
+  "OPENCLAW_PROFILE",
+  "OPENCLAW_STATE_DIR",
+  "PATH",
+  "Path",
+  "PATHEXT",
+  "SYSTEMROOT",
+  "SystemRoot",
+  "TEMP",
+  "TMP",
+  "TMPDIR",
+  "USERPROFILE",
+  "WINDIR",
+  "XDG_CONFIG_HOME",
+  "XDG_STATE_HOME"
+];
+function normalizeOpenClawProfile(raw) {
+  const profile = raw?.trim();
+  if (!profile || profile.toLowerCase() === "default" || !OPENCLAW_PROFILE_PATTERN.test(profile)) {
+    return void 0;
+  }
+  return profile;
+}
+async function discoverOpenClawRelayUrl(options) {
+  const platform = options.platform ?? process.platform;
+  const cwd = options.cwd ?? process.cwd();
+  const filteredEnv = openClawDiscoveryEnvironment(options.env);
+  const command = resolveOpenClawRelayDiscoveryCommandPlan(filteredEnv, platform, options.isFile, cwd);
+  if (!command)
+    return { reason: "unavailable" };
+  const env = sanitizeOpenClawDiscoveryCommandEnvironment(filteredEnv, command, platform, cwd);
+  const result = await (options.run ?? runOpenClawRelayDiscovery)({
+    ...command,
+    env,
+    timeoutMs: options.timeoutMs,
+    maxOutputBytes: OPENCLAW_RELAY_DISCOVERY_MAX_OUTPUT_BYTES,
+    shell: false
+  });
+  return validateDiscoveryCommandResult(result, options.keyId);
+}
+function runOpenClawRelayDiscovery(options, runtime = {}) {
+  return new Promise((resolve) => {
+    const child = (runtime.spawn ?? spawn)(options.executable, [...options.args], {
+      cwd: options.cwd,
+      env: options.env,
+      shell: options.shell,
+      stdio: ["ignore", "pipe", "pipe"],
+      windowsVerbatimArguments: options.platform === "win32",
+      windowsHide: true
+    });
+    const stdout = [];
+    let outputBytes = 0;
+    let settled = false;
+    let terminating = false;
+    let timer;
+    const finish = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      if (timer)
+        clearTimeout(timer);
+      resolve(result);
+    };
+    const terminate = (kind) => {
+      if (settled || terminating)
+        return;
+      terminating = true;
+      child.stdout.destroy();
+      child.stderr.destroy();
+      const plan = createOpenClawRelayDiscoveryTerminationPlan(options, child.pid);
+      const terminateProcessTree = runtime.terminateProcessTree ?? terminateOpenClawRelayDiscoveryProcessTree;
+      let termination = Promise.resolve();
+      if (plan) {
+        try {
+          termination = terminateProcessTree(plan, child);
+        } catch {
+        }
+      }
+      void boundedTreeTermination(termination).finally(() => {
+        child.unref();
+        finish({ kind });
+      });
+    };
+    const collect = (chunk, keep) => {
+      if (settled || terminating)
+        return;
+      outputBytes += chunk.byteLength;
+      if (outputBytes > options.maxOutputBytes) {
+        terminate("overflow");
+        return;
+      }
+      if (keep)
+        stdout.push(chunk);
+    };
+    child.stdout.on("data", (chunk) => collect(chunk, true));
+    child.stderr.on("data", (chunk) => collect(chunk, false));
+    child.once("error", (error) => {
+      if (!terminating)
+        finish({ kind: classifyCommandError(error) });
+    });
+    child.once("close", (code) => {
+      if (!terminating) {
+        finish(code === 0 ? { kind: "success", stdout: Buffer.concat(stdout) } : { kind: "nonzero" });
+      }
+    });
+    timer = setTimeout(() => terminate("timeout"), options.timeoutMs);
+    timer.unref();
+  });
+}
+function resolveOpenClawRelayDiscoveryCommandPlan(env, platform = process.platform, isFile = isRegularFile, cwd = process.cwd()) {
+  if (platform !== "win32")
+    return { executable: "openclaw", args: OPENCLAW_CDP_ARGS, platform };
+  const executable = resolveWindowsCommandInterpreter(env);
+  const openClawShim = resolveWindowsOpenClawShim(env, isFile, cwd);
+  if (!executable || !openClawShim)
+    return void 0;
+  const taskkillExecutable = path.win32.join(path.win32.dirname(executable), "taskkill.exe");
+  if (!isSafeWindowsSystemToolPath(taskkillExecutable, "taskkill.exe"))
+    return void 0;
+  return {
+    executable,
+    // The only variable bytes are the validated absolute shim path. No config,
+    // profile, URL, metadata, or unresolved command name reaches cmd.exe.
+    args: ["/d", "/s", "/c", `""${openClawShim}" ${OPENCLAW_WINDOWS_COMMAND_SUFFIX}"`],
+    cwd: path.win32.dirname(openClawShim),
+    platform,
+    taskkillExecutable
+  };
+}
+function resolveWindowsCommandInterpreter(env) {
+  const systemRoot = env.SYSTEMROOT?.trim() || env.SystemRoot?.trim();
+  const systemCmd = systemRoot && isSafeWindowsSystemRoot(systemRoot) ? path.win32.join(systemRoot, "System32", "cmd.exe") : void 0;
+  const comSpec = env.COMSPEC?.trim() || env.ComSpec?.trim();
+  if (comSpec && isSafeWindowsCmdPath(comSpec)) {
+    const normalizedComSpec = path.win32.normalize(comSpec);
+    if (systemCmd && normalizedComSpec.toLowerCase() === systemCmd.toLowerCase() || !systemCmd && isConventionalWindowsSystemCmd(normalizedComSpec)) {
+      return normalizedComSpec;
+    }
+  }
+  return systemCmd;
+}
+function resolveWindowsOpenClawShim(env, isFile, cwd) {
+  const pathEntries = safeWindowsPathEntries(env.PATH ?? env.Path, cwd);
+  const extensions = windowsPathExtensions(env.PATHEXT);
+  for (const directory of pathEntries) {
+    for (const extension of extensions) {
+      if (extension.toLowerCase() !== ".cmd")
+        continue;
+      const candidate = path.win32.join(directory, `openclaw${extension}`);
+      if (isSafeWindowsCommandPath(candidate) && isFile(candidate))
+        return path.win32.normalize(candidate);
+    }
+  }
+  return void 0;
+}
+function isSafeWindowsCmdPath(value) {
+  return isSafeWindowsSystemToolPath(value, "cmd.exe");
+}
+function isSafeWindowsSystemToolPath(value, basename) {
+  const parent = path.win32.dirname(value);
+  const root = path.win32.dirname(parent);
+  return isSafeWindowsCommandPath(value) && path.win32.basename(value).toLowerCase() === basename && path.win32.basename(parent).toLowerCase() === "system32" && ["windows", "winnt"].includes(path.win32.basename(root).toLowerCase());
+}
+function isSafeWindowsSystemRoot(value) {
+  const basename = path.win32.basename(value).toLowerCase();
+  return isSafeWindowsAbsolutePath(value) && basename !== "cmd.exe" && basename !== "system32";
+}
+function isConventionalWindowsSystemCmd(value) {
+  const parent = path.win32.dirname(value);
+  const root = path.win32.dirname(parent);
+  return path.win32.basename(parent).toLowerCase() === "system32" && ["windows", "winnt"].includes(path.win32.basename(root).toLowerCase());
+}
+function isSafeWindowsAbsolutePath(value) {
+  if (!/^[a-z]:[\\/]/i.test(value) || /["<>|?*]/u.test(value) || hasControlCharacter(value) || value.slice(2).includes(":")) {
+    return false;
+  }
+  const segments = value.replaceAll("/", "\\").split("\\");
+  return !segments.some((segment) => segment === "." || segment === "..");
+}
+function isSafeWindowsCommandPath(value) {
+  return isSafeWindowsAbsolutePath(value) && !/["%&|<>^!]/u.test(value) && !hasControlCharacter(value);
+}
+function hasControlCharacter(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    if (value.charCodeAt(index) < 32)
+      return true;
+  }
+  return false;
+}
+function safeWindowsPathEntries(value, excludedDirectory) {
+  if (!value)
+    return [];
+  const excluded = excludedDirectory && isSafeWindowsCommandPath(excludedDirectory) ? path.win32.resolve(excludedDirectory).toLowerCase() : void 0;
+  return value.split(";").map((entry) => entry.trim()).filter((entry) => entry !== "" && path.win32.isAbsolute(entry) && isSafeWindowsCommandPath(entry)).map((entry) => path.win32.resolve(entry)).filter((entry) => entry.toLowerCase() !== excluded);
+}
+function windowsPathExtensions(value) {
+  const raw = value?.trim() || OPENCLAW_WINDOWS_DEFAULT_PATHEXT;
+  return raw.split(";").map((extension) => extension.trim()).filter((extension) => /^\.[a-z0-9]+$/iu.test(extension));
+}
+function isRegularFile(candidate) {
+  try {
+    return statSync(candidate).isFile();
+  } catch {
+    return false;
+  }
+}
+function sanitizeOpenClawDiscoveryCommandEnvironment(env, command, platform, sourceCwd) {
+  if (platform !== "win32")
+    return env;
+  const sanitized = { ...env };
+  delete sanitized.ComSpec;
+  delete sanitized.COMSPEC;
+  sanitized.ComSpec = command.executable;
+  const safePath = safeWindowsPathEntries(sanitized.PATH ?? sanitized.Path, sourceCwd).join(";");
+  delete sanitized.Path;
+  delete sanitized.PATH;
+  if (safePath)
+    sanitized.Path = safePath;
+  const systemRoot = sanitized.SYSTEMROOT?.trim() || sanitized.SystemRoot?.trim();
+  if (systemRoot && !isSafeWindowsSystemRoot(systemRoot)) {
+    delete sanitized.SystemRoot;
+    delete sanitized.SYSTEMROOT;
+  }
+  return sanitized;
+}
+function createOpenClawRelayDiscoveryTerminationPlan(options, pid) {
+  if (!Number.isSafeInteger(pid) || !pid || pid <= 0)
+    return void 0;
+  if (options.platform !== "win32")
+    return { kind: "posix-sigkill", pid, signal: "SIGKILL" };
+  if (!options.taskkillExecutable || !isSafeWindowsSystemToolPath(options.taskkillExecutable, "taskkill.exe")) {
+    return void 0;
+  }
+  return {
+    kind: "windows-taskkill",
+    pid,
+    executable: options.taskkillExecutable,
+    args: ["/PID", String(pid), "/T", "/F"],
+    shell: false,
+    windowsHide: true
+  };
+}
+async function terminateOpenClawRelayDiscoveryProcessTree(plan, child) {
+  if (plan.kind === "posix-sigkill") {
+    try {
+      child.kill(plan.signal);
+    } catch {
+    }
+    return;
+  }
+  await new Promise((resolve) => {
+    let killer;
+    try {
+      killer = spawn(plan.executable, [...plan.args], {
+        shell: plan.shell,
+        stdio: "ignore",
+        windowsHide: plan.windowsHide
+      });
+    } catch {
+      resolve();
+      return;
+    }
+    let done = false;
+    const finish = () => {
+      if (done)
+        return;
+      done = true;
+      clearTimeout(timer);
+      resolve();
+    };
+    killer.once("error", finish);
+    killer.once("close", finish);
+    const timer = setTimeout(() => {
+      try {
+        killer.kill("SIGKILL");
+      } catch {
+      }
+      finish();
+    }, OPENCLAW_WINDOWS_TREE_KILL_TIMEOUT_MS);
+    timer.unref();
+  });
+}
+async function boundedTreeTermination(termination) {
+  let timer;
+  try {
+    await Promise.race([
+      termination.catch(() => void 0),
+      new Promise((resolve) => {
+        timer = setTimeout(resolve, OPENCLAW_WINDOWS_TREE_KILL_TIMEOUT_MS + 250);
+        timer.unref();
+      })
+    ]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+}
+function classifyCommandError(error) {
+  const details = error;
+  if (details.code === "ENOENT")
+    return "unavailable";
+  if (details.code === "ETIMEDOUT" || details.killed === true)
+    return "timeout";
+  if (details.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER" || details.code === "ENOBUFS")
+    return "overflow";
+  return "nonzero";
+}
+function validateDiscoveryCommandResult(result, expectedKeyId) {
+  if (result.kind !== "success")
+    return { reason: result.kind };
+  if (result.stdout.byteLength > OPENCLAW_RELAY_DISCOVERY_MAX_OUTPUT_BYTES)
+    return { reason: "overflow" };
+  const encoded = result.stdout.toString("utf8").trim();
+  const parseErrors = [];
+  const tree = parseTree(encoded, parseErrors, { allowTrailingComma: false, disallowComments: true });
+  if (!tree || parseErrors.length > 0 || hasDuplicateObjectKeys(tree))
+    return { reason: "malformed" };
+  let metadata;
+  try {
+    metadata = JSON.parse(encoded);
+  } catch {
+    return { reason: "malformed" };
+  }
+  if (!isPlainObject(metadata) || !hasExactKeys(metadata, ["auth", "browserUrl", "wsEndpoint"])) {
+    return { reason: "incompatible" };
+  }
+  if (!isPlainObject(metadata.auth) || !hasExactKeys(metadata.auth, [
+    "challengeUrl",
+    "completeUrl",
+    "flow",
+    "keyId",
+    "label",
+    "method",
+    "resource",
+    "role",
+    "transport",
+    "version"
+  ])) {
+    return { reason: "incompatible" };
+  }
+  const browserUrl = parseBrowserUrl(metadata.browserUrl);
+  if (!browserUrl)
+    return { reason: "unsafe" };
+  const wsEndpoint = parseWebSocketUrl(metadata.wsEndpoint);
+  if (!wsEndpoint || wsEndpoint.host !== browserUrl.host)
+    return { reason: "unsafe" };
+  const auth = metadata.auth;
+  if (auth.label !== BROWSER_RELAY_AUTH_LABEL || auth.version !== BROWSER_RELAY_AUTH_VERSION || auth.role !== BROWSER_RELAY_CDP_ROLE || auth.transport !== BROWSER_RELAY_CDP_TRANSPORT || auth.method !== BROWSER_RELAY_CDP_METHOD || auth.resource !== BROWSER_RELAY_CDP_RESOURCE || auth.flow !== BROWSER_RELAY_CDP_FLOW || auth.challengeUrl !== new URL(BROWSER_RELAY_AUTH_CHALLENGE_PATH, browserUrl).toString() || auth.completeUrl !== new URL(BROWSER_RELAY_AUTH_COMPLETE_PATH, browserUrl).toString()) {
+    return { reason: "incompatible" };
+  }
+  if (auth.keyId !== expectedKeyId)
+    return { reason: "key-id-mismatch" };
+  return { reason: "success", url: browserUrl };
+}
+function parseBrowserUrl(value) {
+  if (typeof value !== "string")
+    return void 0;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname) || url.username !== "" || url.password !== "" || !hasValidPort(url) || url.pathname !== "/" || url.search !== "" || url.hash !== "") {
+    return void 0;
+  }
+  return new URL(url.origin);
+}
+function parseWebSocketUrl(value) {
+  if (typeof value !== "string")
+    return void 0;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "ws:" || !isLoopbackHostname(url.hostname) || url.username !== "" || url.password !== "" || !hasValidPort(url) || url.pathname !== BROWSER_RELAY_CDP_PATH || url.search !== "" || url.hash !== "") {
+    return void 0;
+  }
+  return url;
+}
+function isLoopbackHostname(hostname) {
+  const normalized = hostname.replace(/^\[(.*)\]$/u, "$1").toLowerCase();
+  if (normalized === "localhost" || normalized === "::1")
+    return true;
+  if (net2.isIPv4(normalized))
+    return normalized.startsWith("127.");
+  if (!net2.isIPv6(normalized))
+    return false;
+  return normalized.startsWith("::ffff:127.") || /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/u.test(normalized);
+}
+function hasValidPort(url) {
+  if (url.port === "")
+    return true;
+  const port = Number(url.port);
+  return Number.isSafeInteger(port) && port >= 1 && port <= 65535;
+}
+function isPlainObject(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function hasExactKeys(value, expected) {
+  const actual = Object.keys(value).toSorted();
+  return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
+}
+function hasDuplicateObjectKeys(node) {
+  if (node.type === "object") {
+    const seen = /* @__PURE__ */ new Set();
+    for (const property of node.children ?? []) {
+      const key = property.children?.[0]?.value;
+      if (typeof key !== "string" || seen.has(key))
+        return true;
+      seen.add(key);
+    }
+  }
+  return (node.children ?? []).some(hasDuplicateObjectKeys);
+}
+function openClawDiscoveryEnvironment(env) {
+  const filtered = Object.fromEntries(OPENCLAW_RELAY_DISCOVERY_ENV_KEYS.flatMap((key) => {
+    const value = env[key];
+    return value === void 0 ? [] : [[key, value]];
+  }));
+  const profile = normalizeOpenClawProfile(filtered.OPENCLAW_PROFILE);
+  if (profile)
+    filtered.OPENCLAW_PROFILE = profile;
+  else
+    delete filtered.OPENCLAW_PROFILE;
+  return filtered;
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-relay.js
+var DEFAULT_RELAY_PROBE_TIMEOUT_MS = 5e3;
+var MIN_RELAY_PROBE_TIMEOUT_MS = 100;
+var MAX_RELAY_PROBE_TIMEOUT_MS = 3e4;
+var DEFAULT_RELAY_URL = "http://127.0.0.1:18799";
+var DEFAULT_RELAY_IDENTITY_URL = new URL(DEFAULT_RELAY_URL).toString();
+var RELAY_DEPENDENCY_SENTINEL = "$MCPORTER_CHROME_RELAY_DEPENDENCY:";
+var RELAY_DISCOVERY_SENTINEL = "$MCPORTER_CHROME_RELAY_DISCOVERY:";
+var CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS = [
+  "MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY",
+  "MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY",
+  "MCPORTER_CHROME_DEVTOOLS_RELAY_URL",
+  "MCPORTER_CHROME_DEVTOOLS_RELAY_TIMEOUT_MS",
+  ...OPENCLAW_RELAY_DISCOVERY_ENV_KEYS
+];
+var ChromeDevtoolsRelayRequiredError = class extends Error {
+  decision;
+  constructor(decision) {
+    super(`Chrome DevTools relay policy 'require' could not use the OpenClaw extension relay (${decision.reason}). No chrome-devtools-mcp process was launched.`);
+    this.decision = decision;
+    this.name = "ChromeDevtoolsRelayRequiredError";
+  }
+};
+var lastDecisions = /* @__PURE__ */ new Map();
+function recordChromeDevtoolsRelayDecision(server, decision) {
+  lastDecisions.set(server, decision);
+}
+function getChromeDevtoolsRelayDecision(server) {
+  return lastDecisions.get(server);
+}
+function formatChromeDevtoolsRelayDecision(decision) {
+  return JSON.stringify(decision);
+}
+function resolveChromeDevtoolsRelayProbeTimeoutMs(env = process.env) {
+  const raw = env.MCPORTER_CHROME_DEVTOOLS_RELAY_TIMEOUT_MS?.trim();
+  if (!raw || !/^\d+$/.test(raw))
+    return DEFAULT_RELAY_PROBE_TIMEOUT_MS;
+  const parsed = Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0)
+    return DEFAULT_RELAY_PROBE_TIMEOUT_MS;
+  return Math.min(MAX_RELAY_PROBE_TIMEOUT_MS, Math.max(MIN_RELAY_PROBE_TIMEOUT_MS, parsed));
+}
+function resolveChromeDevtoolsRelayPolicy(configured, env = process.env) {
+  if (env.MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY === "1")
+    return "off";
+  const raw = env.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY?.trim().toLowerCase();
+  if (!raw)
+    return configured ?? "prefer";
+  if (raw === "off" || raw === "prefer" || raw === "require")
+    return raw;
+  throw new Error(`Invalid MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY '${raw}'. Expected off, prefer, or require.`);
+}
+function isChromeDevtoolsAutoConnectCommand(command, args) {
+  return resolveChromeDevtoolsAutoConnectCommand(command, args).enabled;
+}
+function explicitRelayBaseUrl(env) {
+  const raw = env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL?.trim();
+  if (!raw)
+    return { explicit: false };
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return { explicit: true };
+  }
+  if (url.protocol !== "http:" || !["127.0.0.1", "localhost", "[::1]", "::1"].includes(url.hostname) || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") {
+    return { explicit: true };
+  }
+  return { explicit: true, url };
+}
+function resolveOpenClawCredentialDir(env) {
+  const oauthOverride = env.OPENCLAW_OAUTH_DIR?.trim();
+  if (oauthOverride)
+    return resolveOpenClawPath(oauthOverride, env);
+  const stateOverride = env.OPENCLAW_STATE_DIR?.trim();
+  const profile = normalizeOpenClawProfile(env.OPENCLAW_PROFILE);
+  const stateDir = stateOverride ? resolveOpenClawPath(stateOverride, env) : path2.join(resolveOpenClawHome(env), profile ? `.openclaw-${profile}` : ".openclaw");
+  return path2.join(stateDir, "credentials");
+}
+function resolveOpenClawHome(env) {
+  const override = env.OPENCLAW_HOME?.trim();
+  const osHome = resolveOpenClawOsHome(env);
+  if (!override)
+    return osHome;
+  if (override === "~")
+    return osHome;
+  if (override.startsWith("~/") || override.startsWith("~\\")) {
+    return path2.resolve(osHome, override.slice(2));
+  }
+  return path2.resolve(override);
+}
+function resolveOpenClawOsHome(env) {
+  for (const value of [env.HOME, env.USERPROFILE]) {
+    const normalized = value?.trim();
+    if (normalized && normalized !== "undefined" && normalized !== "null")
+      return path2.resolve(normalized);
+  }
+  return os.homedir();
+}
+function resolveOpenClawPath(value, env) {
+  if (value === "~")
+    return resolveOpenClawHome(env);
+  if (value.startsWith("~/") || value.startsWith("~\\")) {
+    return path2.resolve(resolveOpenClawHome(env), value.slice(2));
+  }
+  return path2.resolve(value);
+}
+function defaultReadCredential(env) {
+  const secretPath = path2.join(resolveOpenClawCredentialDir(env), "browser-extension-relay.secret");
+  return readCredentialPath(secretPath);
+}
+function readCredentialPath(secretPath) {
+  let descriptor;
+  try {
+    descriptor = fs.openSync(secretPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+  } catch (error) {
+    return { reason: isErrno(error, "ENOENT") ? "missing-credential" : "invalid-credential" };
+  }
+  try {
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile())
+      return { reason: "invalid-credential" };
+    if (process.platform !== "win32") {
+      if ((stat.mode & 63) !== 0)
+        return { reason: "invalid-credential" };
+      if (typeof process.getuid === "function" && stat.uid !== process.getuid())
+        return { reason: "invalid-credential" };
+    }
+    const encoded = fs.readFileSync(descriptor, "utf8").trim();
+    if (!/^[0-9a-f]{64}$/.test(encoded))
+      return { reason: "invalid-credential" };
+    const key = Buffer.from(encoded, "hex");
+    return { credential: { key, keyId: deriveBrowserRelayKeyId(key) } };
+  } catch {
+    return { reason: "invalid-credential" };
+  } finally {
+    fs.closeSync(descriptor);
+  }
+}
+async function defaultConnect(baseUrl, credential, timeoutMs) {
+  return await connectChromeDevtoolsRelayV2({ baseUrl, credential, timeoutMs });
+}
+async function rewriteChromeDevtoolsArgsForRelay(command, args, env = process.env, options = {}, configuredPolicy) {
+  const relayEnv = selectChromeDevtoolsRelayRuntimeEnvironment(env);
+  const eligible = isChromeDevtoolsAutoConnectCommand(command, args);
+  if (!eligible) {
+    const ambiguous = isAmbiguousChromeDevtoolsAutoConnectCommand(command, args);
+    if (!ambiguous) {
+      return decide({
+        args,
+        applied: false,
+        decision: { route: "legacy", reason: "not-eligible", policy: configuredPolicy ?? "prefer" }
+      }, options);
+    }
+    const ambiguousPolicy = resolveChromeDevtoolsRelayPolicy(configuredPolicy, relayEnv);
+    if (ambiguousPolicy === "require") {
+      return unavailableOrLegacy(args, ambiguousPolicy, "unsupported-command", void 0, options);
+    }
+    return decide({
+      args,
+      applied: false,
+      decision: { route: "legacy", reason: "not-eligible", policy: ambiguousPolicy }
+    }, options);
+  }
+  const policy = resolveChromeDevtoolsRelayPolicy(configuredPolicy, relayEnv);
+  if (policy === "off") {
+    return decide({ args, applied: false, decision: { route: "legacy", reason: "disabled", policy } }, options);
+  }
+  const explicitBase = explicitRelayBaseUrl(relayEnv);
+  if (explicitBase.explicit && !explicitBase.url) {
+    return unavailableOrLegacy(args, policy, "invalid-endpoint", void 0, options);
+  }
+  const loaded = options.readToken ? (() => {
+    const encoded = options.readToken?.();
+    if (!encoded)
+      return { reason: "missing-credential" };
+    if (!/^[0-9a-f]{64}$/u.test(encoded))
+      return { reason: "invalid-credential" };
+    const key = Buffer.from(encoded, "hex");
+    return { credential: { key, keyId: deriveBrowserRelayKeyId(key) } };
+  })() : defaultReadCredential(relayEnv);
+  if (!loaded.credential) {
+    const base = explicitBase.url ?? new URL(DEFAULT_RELAY_URL);
+    const upstreamEndpoint = new URL("/cdp", base);
+    upstreamEndpoint.protocol = "ws:";
+    return unavailableOrLegacy(args, policy, loaded.reason ?? "invalid-credential", upstreamEndpoint.toString(), options);
+  }
+  const timeoutMs = resolveChromeDevtoolsRelayProbeTimeoutMs(relayEnv);
+  try {
+    const base = explicitBase.url ?? (await discoverOpenClawRelayUrl({
+      env: relayEnv,
+      keyId: loaded.credential.keyId,
+      timeoutMs,
+      run: options.discover,
+      platform: options.discovery?.platform,
+      isFile: options.discovery?.isFile,
+      cwd: options.discovery?.cwd
+    })).url ?? new URL(DEFAULT_RELAY_URL);
+    const upstreamEndpoint = new URL("/cdp", base);
+    upstreamEndpoint.protocol = "ws:";
+    const endpoint = upstreamEndpoint.toString();
+    let probe;
+    try {
+      probe = await (options.connect ?? defaultConnect)(base, loaded.credential, timeoutMs);
+    } catch {
+      return unavailableOrLegacy(args, policy, "network-error", endpoint, options);
+    }
+    const probeDetails = { probeDurationMs: probe.durationMs, probeStatus: probe.status };
+    if (probe.reason !== "success" || !probe.upstream) {
+      probe.upstream?.socket.destroy();
+      const reason = probe.reason === "success" ? "protocol" : probe.reason;
+      return unavailableOrLegacy(args, policy, reason, endpoint, options, probeDetails);
+    }
+    let proxy;
+    try {
+      proxy = await (options.startProxy ?? startChromeDevtoolsRelayProxy)({ upstream: probe.upstream });
+    } catch {
+      probe.upstream.socket.destroy();
+      return unavailableOrLegacy(args, policy, "network-error", endpoint, options, probeDetails);
+    }
+    const rewritten = replaceChromeDevtoolsAutoConnectArgs(command, args, ["--wsEndpoint", proxy.endpoint]);
+    try {
+      return decide({
+        args: rewritten,
+        applied: true,
+        endpoint: proxy.endpoint,
+        proxy,
+        decision: { route: "relay", reason: "success", policy, endpoint, ...probeDetails }
+      }, options);
+    } catch (error) {
+      await proxy.close().catch(() => {
+      });
+      throw error;
+    }
+  } finally {
+    loaded.credential.key.fill(0);
+  }
+}
+function unavailableOrLegacy(args, policy, reason, endpoint, options, probe = {}) {
+  const decision = {
+    route: policy === "require" ? "unavailable" : "legacy",
+    reason,
+    policy,
+    endpoint,
+    ...probe
+  };
+  options.onDecision?.(decision);
+  if (policy === "require")
+    throw new ChromeDevtoolsRelayRequiredError(decision);
+  return { args, applied: false, decision };
+}
+function decide(result, options) {
+  options.onDecision?.(result.decision);
+  return result;
+}
+function resolveChromeDevtoolsRelayEnvironment(overrides, env = process.env) {
+  return { ...env, ...resolveRelayDefinitionEnvOverrides(overrides, env) };
+}
+function selectChromeDevtoolsRelayRuntimeEnvironment(env) {
+  return Object.fromEntries(CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS.flatMap((key) => {
+    const value = env[key];
+    return value === void 0 ? [] : [[key, value]];
+  }));
+}
+function sanitizeRelayIdentityEnvironment(env) {
+  const selected = selectChromeDevtoolsRelayRuntimeEnvironment(env);
+  if (selected.MCPORTER_CHROME_DEVTOOLS_RELAY_URL !== void 0) {
+    const explicit = explicitRelayBaseUrl(selected);
+    selected.MCPORTER_CHROME_DEVTOOLS_RELAY_URL = explicit.explicit ? explicit.url?.toString() ?? "invalid-endpoint" : "";
+  }
+  return selected;
+}
+function chromeDevtoolsRelayEnvironmentKeys(definitions, env = process.env) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const definition of definitions) {
+    if (definition.command.kind !== "stdio")
+      continue;
+    const commandValues = [definition.command.command, ...definition.command.args];
+    const commandEnvironmentKeys = new Set(commandValues.flatMap(referencedEnvironmentVariables));
+    const relevant = commandEnvironmentKeys.size > 0 || isChromeDevtoolsAutoConnectCommand(definition.command.command, definition.command.args) || isAmbiguousChromeDevtoolsAutoConnectCommand(definition.command.command, definition.command.args);
+    if (!relevant) {
+      continue;
+    }
+    for (const key of commandEnvironmentKeys)
+      keys.add(`${RELAY_DEPENDENCY_SENTINEL}${key}`);
+    const resolvedDefinitionEnv = resolveRelayIdentityEnvOverrides(definition.env, env);
+    for (const key of CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS) {
+      const override = definition.env?.[key];
+      if (!override)
+        continue;
+      for (const referenced of referencedEnvironmentVariables(override))
+        keys.add(`${RELAY_DEPENDENCY_SENTINEL}${referenced}`);
+    }
+    const resolvedCommand = resolveCommandArgument(definition.command.command, env);
+    const resolvedArgs = resolveCommandArguments(definition.command.args, env);
+    const eligible = isChromeDevtoolsAutoConnectCommand(resolvedCommand, resolvedArgs);
+    if (!eligible && !isAmbiguousChromeDevtoolsAutoConnectCommand(resolvedCommand, resolvedArgs))
+      continue;
+    const environment = sanitizeRelayIdentityEnvironment(resolvedDefinitionEnv);
+    keys.add(`${RELAY_DISCOVERY_SENTINEL}${Buffer.from(JSON.stringify({
+      server: definition.name,
+      eligible,
+      environment,
+      configuredPolicy: definition.chromeDevtoolsRelay
+    }), "utf8").toString("base64url")}`);
+  }
+  return [...keys].toSorted();
+}
+async function resolveChromeDevtoolsRelayRuntimeIdentity(keys, env = process.env, options = {}) {
+  const { values, relays } = relayEnvironmentIdentityValues(keys, env);
+  for (const relay of relays) {
+    let endpoint = relay.endpoint;
+    if (relay.discover && relay.keyId !== "missing-credential" && relay.keyId !== "invalid-credential") {
+      try {
+        const discovered = await discoverOpenClawRelayUrl({
+          env: relay.env,
+          keyId: relay.keyId,
+          timeoutMs: relay.timeoutMs,
+          run: options.discover,
+          platform: options.discovery?.platform,
+          isFile: options.discovery?.isFile,
+          cwd: options.discovery?.cwd
+        });
+        endpoint = discovered.url?.toString() ?? DEFAULT_RELAY_IDENTITY_URL;
+      } catch {
+        endpoint = DEFAULT_RELAY_IDENTITY_URL;
+      }
+    }
+    values.push([relay.server, endpoint]);
+  }
+  return hashRelayIdentityValues(values);
+}
+function createRelayCredentialIdResolver() {
+  const credentialIds = /* @__PURE__ */ new Map();
+  return (credentialPath) => {
+    const cached = credentialIds.get(credentialPath);
+    if (cached)
+      return cached;
+    const loaded = readCredentialPath(credentialPath);
+    const value = loaded.credential?.keyId ?? loaded.reason ?? "missing-credential";
+    loaded.credential?.key.fill(0);
+    credentialIds.set(credentialPath, value);
+    return value;
+  };
+}
+function relayEnvironmentIdentityValues(keys, env) {
+  const credentialId = createRelayCredentialIdResolver();
+  const values = [];
+  const relays = [];
+  for (const key of keys) {
+    if (key.startsWith(RELAY_DEPENDENCY_SENTINEL)) {
+      values.push([key, env[key.slice(RELAY_DEPENDENCY_SENTINEL.length)] ?? null]);
+      continue;
+    }
+    if (!key.startsWith(RELAY_DISCOVERY_SENTINEL)) {
+      values.push([key, relayEnvironmentIdentityValue(key, env)]);
+      continue;
+    }
+    const payload = parseRelayDiscoveryIdentity(key.slice(RELAY_DISCOVERY_SENTINEL.length));
+    if (!payload)
+      throw new Error("Invalid Chrome DevTools relay identity metadata");
+    const effectiveEnv = { ...selectChromeDevtoolsRelayRuntimeEnvironment(env), ...payload.environment };
+    const policy = resolveChromeDevtoolsRelayPolicy(payload.configuredPolicy, effectiveEnv);
+    const timeoutMs = resolveChromeDevtoolsRelayProbeTimeoutMs(effectiveEnv);
+    const explicit = explicitRelayBaseUrl(effectiveEnv);
+    const credentialDir = resolveOpenClawCredentialDir(effectiveEnv);
+    const keyId = payload.eligible ? credentialId(path2.join(credentialDir, "browser-extension-relay.secret")) : "not-eligible";
+    const server = `$relay:${payload.server}`;
+    values.push([
+      server,
+      JSON.stringify({
+        policy,
+        timeoutMs,
+        eligible: payload.eligible,
+        credentialDir,
+        keyId,
+        // These values also reach the discovery subprocess; retain inputs whose equivalence it does not guarantee.
+        discovery: OPENCLAW_RELAY_DISCOVERY_ENV_KEYS.map((name) => [
+          name,
+          relayEnvironmentIdentityValue(name, effectiveEnv)
+        ]),
+        cwd: relayIdentityDependsOnCwd(effectiveEnv) ? process.cwd() : null
+      })
+    ]);
+    relays.push({
+      server,
+      env: effectiveEnv,
+      timeoutMs,
+      keyId,
+      endpoint: policy === "off" ? "disabled" : explicit.explicit ? explicit.url?.toString() ?? "invalid-endpoint" : DEFAULT_RELAY_IDENTITY_URL,
+      discover: payload.eligible && policy !== "off" && !explicit.explicit
+    });
+  }
+  if (keys.length > 0)
+    values.push(["$relayAuth", "v2-effective-metadata-discovery"]);
+  return { values, relays };
+}
+function relayEnvironmentIdentityValue(key, env) {
+  switch (key) {
+    case "MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY":
+    case "MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY":
+      return resolveChromeDevtoolsRelayPolicy(void 0, env);
+    case "MCPORTER_CHROME_DEVTOOLS_RELAY_TIMEOUT_MS":
+      return resolveChromeDevtoolsRelayProbeTimeoutMs(env);
+    case "MCPORTER_CHROME_DEVTOOLS_RELAY_URL": {
+      const explicit = explicitRelayBaseUrl(env);
+      return explicit.explicit ? explicit.url?.toString() ?? "invalid-endpoint" : DEFAULT_RELAY_IDENTITY_URL;
+    }
+    case "OPENCLAW_PROFILE":
+      return normalizeOpenClawProfile(env.OPENCLAW_PROFILE) ?? null;
+    default:
+      return env[key] ?? null;
+  }
+}
+function relayIdentityDependsOnCwd(env) {
+  const paths = [
+    env.HOME,
+    env.USERPROFILE,
+    env.OPENCLAW_HOME,
+    env.OPENCLAW_STATE_DIR,
+    env.OPENCLAW_OAUTH_DIR,
+    env.OPENCLAW_CONFIG_PATH,
+    ...(env.PATH ?? env.Path)?.split(path2.delimiter) ?? []
+  ];
+  return paths.some((value) => value !== void 0 && !path2.isAbsolute(value) && !value.startsWith("~"));
+}
+function hashRelayIdentityValues(values) {
+  return createHash3("sha256").update(JSON.stringify(values.toSorted((a, b) => a[0].localeCompare(b[0]) || JSON.stringify(a[1]).localeCompare(JSON.stringify(b[1]))))).digest("hex").slice(0, 16);
+}
+function parseRelayDiscoveryIdentity(encoded) {
+  try {
+    const value = JSON.parse(Buffer.from(encoded, "base64url").toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return void 0;
+    const candidate = value;
+    if (typeof candidate.server !== "string" || typeof candidate.eligible !== "boolean" || !candidate.environment || typeof candidate.environment !== "object")
+      return void 0;
+    if (candidate.configuredPolicy !== void 0 && !["off", "prefer", "require"].includes(candidate.configuredPolicy))
+      return void 0;
+    const environment = {};
+    for (const [key, raw] of Object.entries(candidate.environment)) {
+      if (!CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS.includes(key) || typeof raw !== "string")
+        return void 0;
+      environment[key] = raw;
+    }
+    return {
+      server: candidate.server,
+      eligible: candidate.eligible,
+      environment,
+      configuredPolicy: candidate.configuredPolicy
+    };
+  } catch {
+    return void 0;
+  }
+}
+function referencedEnvironmentVariables(value) {
+  const names = /* @__PURE__ */ new Set();
+  if (value.startsWith("$env:"))
+    names.add(value.slice("$env:".length));
+  for (const match of value.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)/gu)) {
+    if (match[1])
+      names.add(match[1]);
+  }
+  return [...names];
+}
+function resolveRelayDefinitionEnvOverrides(overrides, env) {
+  const resolved = {};
+  for (const [key, raw] of Object.entries(overrides ?? {})) {
+    const value = resolveEnvValue(raw, env);
+    if (value !== "")
+      resolved[key] = value;
+  }
+  return resolved;
+}
+function resolveRelayIdentityEnvOverrides(overrides, env) {
+  const relevant = Object.fromEntries(CHROME_DEVTOOLS_RELAY_RUNTIME_ENV_KEYS.flatMap((key) => {
+    const value = overrides?.[key];
+    return value === void 0 ? [] : [[key, value]];
+  }));
+  return resolveRelayDefinitionEnvOverrides(relevant, env);
+}
+function isErrno(error, code) {
+  return Boolean(error && typeof error === "object" && error.code === code);
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/daemon/connection-identity.js
+var BROKER_ENV = /* @__PURE__ */ new Set([
+  "MCPORTER_DAEMON_DIR",
+  "MCPORTER_DAEMON_CHILD",
+  "MCPORTER_DAEMON_SOCKET",
+  "MCPORTER_DAEMON_METADATA",
+  "MCPORTER_CONFIG",
+  "MCPORTER_DISABLE_AUTORUN",
+  "MCPORTER_DAEMON_LOG",
+  "MCPORTER_DAEMON_LOG_PATH",
+  "MCPORTER_DAEMON_LOG_SERVERS",
+  "MCPORTER_NO_FORCE_EXIT"
+]);
+async function effectiveDefinition(definition, inherited = process.env, purpose = "connection") {
+  const env = Object.fromEntries(Object.entries(resolveChromeDevtoolsRelayEnvironment(definition.env, inherited)).filter(([key, value]) => value !== void 0 && !BROKER_ENV.has(key)));
+  const configuredEnv = Object.fromEntries(Object.keys(definition.env ?? {}).filter((key) => !BROKER_ENV.has(key)).map((key) => [key, env[key] ?? ""]));
+  normalizeChromeEnvironment(definition, env);
+  const chrome = isChromeDefinition(definition);
+  const launchCommand = definition.command.kind === "stdio" ? resolveCommandArgument(definition.command.command, env) : void 0;
+  const command = definition.command.kind === "stdio" ? {
+    ...definition.command,
+    command: chrome && purpose === "view" ? launchCommand : await resolveExecutable(launchCommand, env, definition.command.cwd),
+    args: resolveCommandArguments(definition.command.args, env),
+    cwd: await fs2.realpath(definition.command.cwd)
+  } : { ...definition.command, url: new URL(definition.command.url) };
+  if (command.kind === "stdio") {
+    if (!Object.hasOwn(configuredEnv, "PWD"))
+      env.PWD = command.cwd;
+    if (!Object.hasOwn(configuredEnv, "SHLVL"))
+      delete env.SHLVL;
+  }
+  return { ...definition, command, env, configuredEnv, ...chrome ? { launchCommand } : {} };
+}
+function normalizeChromeEnvironment(definition, env) {
+  if (isChromeDefinition(definition)) {
+    env.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY = resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, env);
+    env.MCPORTER_CHROME_DEVTOOLS_RELAY_TIMEOUT_MS = String(resolveChromeDevtoolsRelayProbeTimeoutMs(env));
+    delete env.MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY;
+    if (!env.OPENCLAW_PROFILE?.trim() || env.OPENCLAW_PROFILE.trim() === "default")
+      delete env.OPENCLAW_PROFILE;
+    if (env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL?.trim())
+      env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL = new URL(env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL.trim()).toString();
+    else
+      delete env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL;
+  }
+}
+async function resolveExecutable(command, env, cwd) {
+  const roots = /[/\\]/.test(command) ? [path3.resolve(cwd, command)] : (env.PATH ?? env.Path ?? "").split(path3.delimiter).map((dir) => path3.resolve(cwd, dir, command));
+  const extensions = process.platform === "win32" && !path3.extname(command) ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";")] : [""];
+  const candidates = roots.flatMap((root) => extensions.map((extension) => root + extension));
+  for (const candidate of candidates) {
+    try {
+      await fs2.access(candidate, fs2.constants.X_OK);
+      return path3.join(await fs2.realpath(path3.dirname(candidate)), path3.basename(candidate));
+    } catch {
+    }
+  }
+  throw new Error("Unable to resolve configured executable from the effective PATH.");
+}
+function connectionIdentity(definition) {
+  const { name, description: _description, source: _source, sources: _sources, allowedTools: _allowed, blockedTools: _blocked, lifecycle: _lifecycle, configuredEnv: _configuredEnv, launchCommand: _launchCommand, logging: _logging, ...connection } = definition;
+  const credentialOwner = definition.auth || definition.command.kind === "http" ? name : void 0;
+  const env = { ...definition.env };
+  const chrome = isChromeDefinition(definition);
+  if (chrome) {
+    env.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY = resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, env);
+    delete env.MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY;
+    env.MCPORTER_CHROME_DEVTOOLS_RELAY_TIMEOUT_MS = String(resolveChromeDevtoolsRelayProbeTimeoutMs(env));
+  }
+  return createHash4("sha256").update(stableJsonStringify({
+    ...connection,
+    env,
+    credentialOwner,
+    idleTimeoutMs: !chrome && definition.lifecycle?.mode === "keep-alive" ? definition.lifecycle.idleTimeoutMs : void 0,
+    protocolVersion: definition.protocolVersion ?? "auto",
+    httpFetch: definition.httpFetch ?? "default",
+    chromeDevtoolsRelay: chrome ? env.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY : void 0
+  })).digest("hex");
+}
+function isChromeDefinition(definition) {
+  return definition.command.kind === "stdio" && [definition.name, definition.command.command, ...definition.command.args].some((value) => /chrome[-_]devtools(?:[-_]mcp)?/i.test(value));
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/daemon/browser-owner.js
+import os4 from "node:os";
+import path6 from "node:path";
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/daemon/paths.js
+import fs4 from "node:fs/promises";
+import { constants } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-relay-handoff.js
+import { spawnSync } from "node:child_process";
+import { randomBytes as randomBytes3 } from "node:crypto";
+import fs3 from "node:fs";
+import os2 from "node:os";
+import path4 from "node:path";
+import { pathToFileURL } from "node:url";
+var CHROME_RELAY_HANDOFF_ENV = "MCPORTER_CHROME_RELAY_HANDOFF_PATH";
+var HANDOFF_DIR_PREFIX = "mcporter-chrome-relay-";
+var HANDOFF_FILENAME = "headers.json";
+var PRELOAD_FILENAME = "preload.mjs";
+var WINDOWS_ACL_PATH_ENV = "MCPORTER_CHROME_RELAY_ACL_PATH";
+function createChromeDevtoolsRelayHandoff(env, clientAuthorization) {
+  let directory;
+  try {
+    if (process.platform === "win32")
+      directory = createWindowsHandoffDirectory();
+    else {
+      directory = fs3.mkdtempSync(path4.join(os2.tmpdir(), HANDOFF_DIR_PREFIX));
+      fs3.chmodSync(directory, 448);
+    }
+    assertSecurePath(directory, "directory");
+    const handoffPath = path4.join(directory, HANDOFF_FILENAME);
+    const preloadPath = path4.join(directory, PRELOAD_FILENAME);
+    writeExclusiveFile(preloadPath, renderChromeDevtoolsRelayPreloadSource());
+    writeExclusiveFile(handoffPath, JSON.stringify({ Authorization: clientAuthorization }));
+    const importFlag = `--import=${pathToFileURL(preloadPath).href}`;
+    const existingOptions = env.NODE_OPTIONS?.trim();
+    let closed = false;
+    return {
+      env: {
+        ...env,
+        NODE_OPTIONS: existingOptions ? `${existingOptions} ${importFlag}` : importFlag,
+        [CHROME_RELAY_HANDOFF_ENV]: handoffPath
+      },
+      handoffPath,
+      preloadPath,
+      async close() {
+        if (closed)
+          return;
+        closed = true;
+        cleanupHandoff(directory, handoffPath, preloadPath);
+      }
+    };
+  } catch (error) {
+    if (directory)
+      cleanupHandoff(directory, path4.join(directory, HANDOFF_FILENAME), path4.join(directory, PRELOAD_FILENAME));
+    const diagnostic = error instanceof Error && error.message.startsWith("Windows ACL setup failed:") ? ` ${error.message}` : "";
+    throw new Error(`Unable to install secure Chrome relay authorization handoff.${diagnostic}`, { cause: error });
+  }
+}
+function createWindowsHandoffDirectory() {
+  const directory = path4.join(os2.tmpdir(), `${HANDOFF_DIR_PREFIX}${randomBytes3(16).toString("hex")}`);
+  ensureWindowsPrivateDirectory(directory);
+  return directory;
+}
+function ensureWindowsPrivateDirectory(directory, allowExisting = false) {
+  const script = String.raw`
+$ErrorActionPreference = 'Stop'
+$stage = 'identity'
+try {
+$target = $env:${WINDOWS_ACL_PATH_ENV}
+${allowExisting ? "" : "if ([System.IO.Directory]::Exists($target)) { throw 'handoff path already exists' }"}
+if ([System.IO.Directory]::Exists($target) -and (([System.IO.File]::GetAttributes($target) -band [System.IO.FileAttributes]::ReparsePoint) -ne 0)) { throw 'unsafe reparse point' }
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$stage = 'descriptor'
+$security = New-Object System.Security.AccessControl.DirectorySecurity
+$sidValue = $sid.Value
+$security.SetSecurityDescriptorSddlForm("O:$($sidValue)G:$($sidValue)D:P(A;OICI;FA;;;$($sidValue))")
+$directory = New-Object System.IO.DirectoryInfo -ArgumentList @($target)
+$stage = 'create'
+$directory.Create($security)
+$stage = 'acl-read'
+$check = $directory.GetAccessControl([System.Security.AccessControl.AccessControlSections]::All)
+$rules = @($check.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+$ownerSid = $check.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+$stage = 'acl-verify'
+if (-not $check.AreAccessRulesProtected -or $ownerSid -ne $sid.Value -or $rules.Count -ne 1) { throw 'unsafe ACL' }
+$ruleSid = $rules[0].IdentityReference.Value
+$hasFullControl = ($rules[0].FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl
+if ($ruleSid -ne $sid.Value -or $rules[0].IsInherited -or -not $hasFullControl -or $rules[0].AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { throw 'unsafe ACL' }
+} catch {
+  $type = $_.Exception.GetType().FullName
+  $hresult = ('0x{0:X8}' -f ($_.Exception.HResult -band 0xffffffffL))
+  [Console]::Error.WriteLine("stage=$stage type=$type hresult=$hresult")
+  exit 1
+}
+`;
+  const result = spawnSync(resolveSystemPowerShellPath(), ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+    encoding: "utf8",
+    env: { ...process.env, [WINDOWS_ACL_PATH_ENV]: directory },
+    stdio: ["ignore", "ignore", "pipe"],
+    windowsHide: true
+  });
+  if (result.status !== 0) {
+    try {
+      if (!allowExisting)
+        fs3.rmdirSync(directory);
+    } catch {
+    }
+    const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+    const safeDetail = /^[A-Za-z0-9_.:=\- ]{1,240}$/u.test(stderr) ? stderr : `stage=spawn type=${result.error?.code ?? "unknown"} hresult=unknown`;
+    throw new Error(`Windows ACL setup failed: ${safeDetail}`);
+  }
+}
+function resolveSystemPowerShellPath() {
+  const systemRoot = process.env.SystemRoot?.trim() || process.env.WINDIR?.trim();
+  if (!systemRoot || !path4.win32.isAbsolute(systemRoot))
+    throw new Error("unsafe Windows system root");
+  const executable = path4.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  const stat = fs3.lstatSync(executable);
+  if (!stat.isFile() || stat.isSymbolicLink())
+    throw new Error("unsafe Windows PowerShell path");
+  return executable;
+}
+function writeExclusiveFile(filePath, contents) {
+  const descriptor = fs3.openSync(filePath, fs3.constants.O_WRONLY | fs3.constants.O_CREAT | fs3.constants.O_EXCL | (fs3.constants.O_NOFOLLOW ?? 0), 384);
+  try {
+    if (process.platform !== "win32")
+      fs3.fchmodSync(descriptor, 384);
+    fs3.writeFileSync(descriptor, contents, "utf8");
+  } finally {
+    fs3.closeSync(descriptor);
+  }
+  assertSecurePath(filePath, "file");
+}
+function assertSecurePath(filePath, kind) {
+  const stat = fs3.lstatSync(filePath);
+  if ((kind === "directory" ? !stat.isDirectory() : !stat.isFile()) || stat.isSymbolicLink())
+    throw new Error("unsafe");
+  if (process.platform === "win32")
+    return;
+  if ((stat.mode & 63) !== 0)
+    throw new Error("unsafe");
+  if (typeof process.getuid === "function" && stat.uid !== process.getuid())
+    throw new Error("unsafe");
+}
+function cleanupHandoff(directory, handoffPath, preloadPath) {
+  for (const filePath of [handoffPath, preloadPath]) {
+    try {
+      fs3.unlinkSync(filePath);
+    } catch {
+    }
+  }
+  try {
+    fs3.rmdirSync(directory);
+  } catch {
+  }
+}
+function renderChromeDevtoolsRelayPreloadSource() {
+  return `import fs from 'node:fs';
+import path from 'node:path';
+
+const targetPath = process.argv[1]?.replaceAll('\\\\', '/').toLowerCase();
+if (targetPath?.includes('chrome-devtools-mcp')) {
+  const failureMessage = 'MCPorter Chrome relay authorization handoff unavailable.';
+  const fail = () => {
+    throw new Error(failureMessage);
+  };
+  const envName = ${JSON.stringify(CHROME_RELAY_HANDOFF_ENV)};
+  const handoffPath = process.env[envName];
+  delete process.env[envName];
+  if (!handoffPath || !path.isAbsolute(handoffPath)) fail();
+
+  const directoryStat = (() => {
+    try {
+      return fs.lstatSync(path.dirname(handoffPath));
+    } catch {
+      return fail();
+    }
+  })();
+  if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) fail();
+  if (process.platform !== 'win32') {
+    if ((directoryStat.mode & 0o077) !== 0) fail();
+    if (typeof process.getuid === 'function' && directoryStat.uid !== process.getuid()) fail();
+  }
+
+  const descriptor = (() => {
+    try {
+      return fs.openSync(handoffPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    } catch {
+      return fail();
+    }
+  })();
+
+  let raw = '';
+  let consumed = false;
+  try {
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile() || stat.size <= 0 || stat.size > 4_096) fail();
+    if (process.platform !== 'win32') {
+      if ((stat.mode & 0o077) !== 0) fail();
+      if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) fail();
+    }
+    raw = fs.readFileSync(descriptor, 'utf8');
+    try {
+      fs.unlinkSync(handoffPath);
+      consumed = true;
+    } catch {
+      try {
+        fs.ftruncateSync(descriptor, 0);
+        consumed = true;
+      } catch {
+        fail();
+      }
+    }
+  } finally {
+    fs.closeSync(descriptor);
+  }
+  if (!consumed) fail();
+
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    fail();
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) fail();
+  const entries = Object.entries(parsed);
+  if (entries.length !== 1 || entries[0]?.[0] !== 'Authorization') fail();
+  const authorization = entries[0]?.[1];
+  if (typeof authorization !== 'string' || !/^Bearer [A-Za-z0-9_-]{43}$/u.test(authorization)) fail();
+
+  const terminatorIndex = process.argv.indexOf('--', 2);
+  const insertionIndex = terminatorIndex >= 0 ? terminatorIndex : process.argv.length;
+  process.argv.splice(insertionIndex, 0, '--wsHeaders', JSON.stringify({ Authorization: authorization }));
+}
+`;
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/daemon/paths.js
+import os3 from "node:os";
+import path5 from "node:path";
+function daemonBaseDir() {
+  const override = process.env.MCPORTER_DAEMON_DIR?.trim();
+  if (override)
+    return path5.resolve(override);
+  return path5.join(os3.userInfo().homedir, ".mcporter");
+}
+function daemonRunDir() {
+  return path5.join(daemonBaseDir(), "daemon");
+}
+var verifiedWindowsDirectory;
+async function secureDaemonDirectory() {
+  if (process.platform === "win32") {
+    const directory = daemonRunDir();
+    const previous = await fs4.lstat(directory).catch((error) => {
+      if (error.code !== "ENOENT")
+        throw error;
+      return void 0;
+    });
+    await verifyWindowsDaemonDirectory(directory, previous);
+    return;
+  }
+  await fs4.mkdir(daemonRunDir(), { recursive: true, mode: 448 });
+  assertPosixDaemonDirectory(await fs4.lstat(daemonRunDir()), false);
+}
+async function verifyWindowsDaemonDirectory(directory, previous) {
+  if (previous && (!previous.isDirectory() || previous.isSymbolicLink()))
+    throw new Error("Unsafe daemon directory.");
+  if (verifiedWindowsDirectory?.path !== directory || !previous || previous.dev !== verifiedWindowsDirectory.dev || previous.ino !== verifiedWindowsDirectory.ino || previous.birthtimeMs !== verifiedWindowsDirectory.birthtimeMs) {
+    ensureWindowsPrivateDirectory(directory, true);
+    const info = await fs4.lstat(directory);
+    if (!info.isDirectory() || info.isSymbolicLink())
+      throw new Error("Unsafe daemon directory.");
+    verifiedWindowsDirectory = { path: directory, dev: info.dev, ino: info.ino, birthtimeMs: info.birthtimeMs };
+  }
+}
+function assertPosixDaemonDirectory(info, allowLegacy) {
+  if (info.isDirectory() && !info.isSymbolicLink() && info.uid === process.getuid?.()) {
+    const mode = info.mode & 4095;
+    if (mode === 448 || allowLegacy && mode === 493)
+      return;
+    if (mode === 493)
+      throw new Error("Legacy daemon directory has mode 0755. Inspect with daemon migrate; after draining all old clients, run daemon migrate --stop-legacy --confirmed-drained to upgrade it to mode 0700.");
+  }
+  throw new Error("Daemon directory must be a current-user-owned directory (mode 0700), without symlinks.");
+}
+async function inspectLegacyDaemonDirectory(directory) {
+  const info = await fs4.lstat(directory).catch((error) => {
+    if (error.code !== "ENOENT")
+      throw error;
+    return void 0;
+  });
+  if (!info)
+    return false;
+  if (process.platform === "win32") {
+    await verifyWindowsDaemonDirectory(directory, info);
+  } else
+    assertPosixDaemonDirectory(info, true);
+  return true;
+}
+async function upgradeLegacyDaemonDirectory(directory) {
+  if (!await inspectLegacyDaemonDirectory(directory) || process.platform === "win32")
+    return;
+  const before = await fs4.lstat(directory);
+  assertPosixDaemonDirectory(before, true);
+  const handle = await fs4.open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+  const assertIdentity = (info) => {
+    assertPosixDaemonDirectory(info, true);
+    if (info.dev !== before.dev || info.ino !== before.ino)
+      throw new Error("Daemon directory changed during migration; inspect it before retrying.");
+  };
+  try {
+    const opened = await handle.stat();
+    assertIdentity(opened);
+    assertIdentity(await fs4.lstat(directory));
+    if ((opened.mode & 4095) === 493)
+      await handle.chmod(448);
+    assertPosixDaemonDirectory(await handle.stat(), false);
+    const after = await fs4.lstat(directory);
+    assertIdentity(after);
+    assertPosixDaemonDirectory(after, false);
+  } finally {
+    await handle.close();
+  }
+}
+function getDaemonMetadataPath(_configKey) {
+  return path5.join(daemonRunDir(), "user.json");
+}
+function getDaemonSocketPath(_configKey) {
+  if (process.platform === "win32")
+    return `\\\\.\\pipe\\mcporter-user-${createHash5("sha256").update(daemonRunDir().toLowerCase()).digest("hex").slice(0, 24)}`;
+  return path5.join(daemonRunDir(), "user.sock");
+}
+function getDaemonLogPath(_configKey) {
+  return path5.join(daemonRunDir(), "user.log");
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/daemon/browser-owner.js
+var BrowserOwnerConflict = class extends Error {
+  code = "browser_owner_conflict";
+  constructor(reason) {
+    super(`Existing Chrome owner conflict: ${reason}. Use the canonical Chrome definition; drain and stop the daemon before deliberately changing ownership. This request was not retried.`);
+  }
+};
+function isCanonicalChromeNamespace() {
+  return path6.resolve(daemonBaseDir()) === path6.join(os4.userInfo().homedir, ".mcporter");
+}
+async function canonicalUserConfiguration() {
+  if (!isCanonicalChromeNamespace())
+    return { definitions: [] };
+  const home = os4.userInfo().homedir;
+  const file = mcporterConfigCandidates({ home }).find(pathExists);
+  if (!file)
+    return { definitions: [] };
+  const definitions = [];
+  const canonicalEnv = { ...process.env, HOME: home };
+  if (canonicalEnv.USERPROFILE !== void 0)
+    canonicalEnv.USERPROFILE = home;
+  for (const name of Object.keys(canonicalEnv))
+    if (name.startsWith("MCPORTER_CHROME_DEVTOOLS_RELAY_") || name === "MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY" || name.startsWith("OPENCLAW_"))
+      delete canonicalEnv[name];
+  const raw = await readConfigFile(file, true);
+  for (const [name, entry] of Object.entries(raw.mcpServers)) {
+    const launchTokens = [
+      name,
+      ...Array.isArray(entry.command) ? entry.command : [entry.command ?? ""],
+      ...entry.args ?? []
+    ];
+    if (!launchTokens.some((token) => /chrome[-_]devtools(?:[-_]mcp)?/i.test(token)))
+      continue;
+    const definition = normalizeServerEntry(name, entry, path6.dirname(file), { kind: "local", path: file }, [], {
+      env: canonicalEnv,
+      home
+    });
+    if (supportedOwner(definition))
+      definitions.push(await effectiveDefinition(definition, canonicalEnv));
+  }
+  return { definitions, idleTimeoutMs: raw.daemonIdleTimeoutMs ?? raw.daemon_idle_timeout_ms };
+}
+function supportedOwner(definition) {
+  return isChromeDefinition(definition) && definition.command.kind === "stdio" && resolveChromeDevtoolsAutoConnectCommand(definition.command.command, definition.command.args).enabled;
+}
+var BrowserOwner = class {
+  identity;
+  logicalIdentity;
+  canonicalKeys;
+  canonical;
+  get reserved() {
+    return this.identity !== void 0;
+  }
+  constructor(canonical) {
+    this.canonical = canonical.filter(supportedOwner);
+    this.canonicalKeys = new Set(this.canonical.map(connectionIdentity));
+  }
+  reserve(definition) {
+    if (!isChromeDefinition(definition))
+      return definition;
+    if (!isCanonicalChromeNamespace())
+      throw new BrowserOwnerConflict("existing local Chrome is forbidden in an isolated daemon directory");
+    if (definition.command.kind !== "stdio")
+      return definition;
+    if (!resolveChromeDevtoolsAutoConnectCommand(definition.command.command, definition.command.args).enabled)
+      throw new BrowserOwnerConflict("direct endpoints, wrappers and profile labels do not prove a distinct browser");
+    const configured = this.canonical[0];
+    if (this.canonicalKeys.size !== 1 || !configured)
+      throw new BrowserOwnerConflict("canonical global Chrome definitions are missing or conflicting");
+    const overrides = definition.configuredEnv ?? definition.env;
+    if (definition.chromeDevtoolsRelay && resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, overrides ?? {}) !== resolveChromeDevtoolsRelayPolicy(configured.chromeDevtoolsRelay, configured.env))
+      throw new BrowserOwnerConflict("canonical relay policy differs");
+    const env = { ...configured.env, ...overrides };
+    normalizeChromeEnvironment(definition, env);
+    const command = configured.command.kind === "stdio" && definition.command.command === configured.launchCommand ? { ...definition.command, command: configured.command.command } : definition.command;
+    const candidate = { ...definition, command, env };
+    const identity = connectionIdentity(candidate);
+    if (!this.canonicalKeys.has(identity))
+      throw new BrowserOwnerConflict("request does not match the complete canonical global Chrome connection contract");
+    const policy = resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, env);
+    if (policy !== resolveChromeDevtoolsRelayPolicy(configured.chromeDevtoolsRelay, configured.env))
+      throw new BrowserOwnerConflict("canonical relay policy differs");
+    if (this.identity && this.identity !== identity)
+      throw new BrowserOwnerConflict("an incompatible pending or live connection already owns the browser");
+    this.identity = identity;
+    return configured;
+  }
+  async resolveIdentity(definition) {
+    const resolve = () => resolveChromeDevtoolsRelayRuntimeIdentity(chromeDevtoolsRelayEnvironmentKeys([definition], definition.env), definition.env);
+    if (!this.logicalIdentity)
+      this.logicalIdentity = resolve();
+    const retained = await this.logicalIdentity;
+    const current = await resolve();
+    if (retained !== current)
+      throw new BrowserOwnerConflict("relay endpoint, credential generation or security context changed; explicit retirement is required");
+    return retained;
+  }
+};
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/daemon/transport-authority.js
+var authority = /* @__PURE__ */ Symbol("broker transport authority");
+function authorizeBrokerDefinition(definition, validateRequest) {
+  Object.defineProperty(definition, authority, { value: { validateRequest }, enumerable: true });
+}
+function validateBrokerRequestAuthority(definition) {
+  return definition?.[authority]?.validateRequest?.();
+}
+function isBrokerDefinition(definition) {
+  return Boolean(definition?.[authority]);
+}
+function assertChromeBrokerAuthority(definition) {
+  if (isChromeDefinition(definition) && !isBrokerDefinition(definition)) {
+    throw new BrowserOwnerConflict("programmatic or ephemeral Chrome attachment must use the daemon-backed runtime");
+  }
+}
+
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime-process-utils.js
+import { execFile } from "node:child_process";
+async function closeTransportAndWait(logger, transport, options = {}) {
+  const pidBeforeClose = getTransportPid(transport);
+  const targetsBeforeClose = pidBeforeClose ? await collectProcessTreePids(pidBeforeClose) : [];
+  let closeError;
+  let closeSettled = false;
+  const closePromise = (options.close ?? (() => transport.close()))().catch((error) => {
+    closeError = error;
+    if (!options.throwOnCloseError) {
+      logger.warn(`Failed to close transport cleanly: ${error.message}`);
+    }
+  }).finally(() => {
+    closeSettled = true;
+  });
+  if (pidBeforeClose) {
+    destroyTransportStreams(transport);
+    await ensureProcessTreeTerminated(logger, pidBeforeClose, targetsBeforeClose, options.requireRetirement);
+    if (!closeSettled) {
+      await Promise.race([closePromise, delay(100)]);
+    }
+  } else {
+    await closePromise;
+  }
+  if (closeError && options.throwOnCloseError) {
+    if (options.requireRetirement)
+      throw Object.assign(new Error("Transport retirement failed.", { cause: closeError }), {
+        code: "transport_retirement_failed"
+      });
+    throw closeError;
+  }
+}
+function getTransportPid(transport) {
+  if ("pid" in transport) {
+    const candidate = transport.pid;
+    if (typeof candidate === "number" && candidate > 0) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ensureProcessTreeTerminated(logger, rootPid, capturedTargets = [], requireRetirement = false) {
+  let targets = uniquePids([...capturedTargets, ...await collectProcessTreePids(rootPid)]);
+  if (targets.length === 0 || await waitForTreeExit(targets, 700)) {
+    return;
+  }
+  await sendSignalToTargets(targets, "SIGTERM");
+  targets = uniquePids([...targets, ...await collectProcessTreePids(rootPid)]);
+  if (await waitForTreeExit(targets, 700)) {
+    return;
+  }
+  targets = uniquePids([...targets, ...await collectProcessTreePids(rootPid)]);
+  await sendSignalToTargets(targets, "SIGKILL");
+  if (await waitForTreeExit(targets, 500)) {
+    return;
+  }
+  if (requireRetirement)
+    throw Object.assign(new Error("Transport process retirement could not be verified."), {
+      code: "transport_retirement_failed"
+    });
+  logger.warn(`Process tree rooted at pid=${rootPid} did not exit after SIGKILL.`);
+}
+function uniquePids(pids) {
+  return [...new Set(pids.filter((pid) => Number.isInteger(pid) && pid > 0))];
+}
+function destroyTransportStreams(transport) {
+  const candidate = transport;
+  for (const key of ["stdin", "stdout", "stderr"]) {
+    try {
+      const stream = candidate[key];
+      stream?.destroy?.();
+    } catch {
+    }
+  }
+}
+async function sendSignalToTargets(pids, signal) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const pid of pids) {
+    if (seen.has(pid)) {
+      continue;
+    }
+    seen.add(pid);
+    sendSignal(pid, signal);
+  }
+}
+function sendSignal(pid, signal) {
+  try {
+    process.kill(pid, signal);
+  } catch (error) {
+    if (typeof error === "object" && error && "code" in error && error.code === "ESRCH") {
+      return;
+    }
+    throw error;
+  }
+}
+async function listDescendantPids(rootPid) {
+  if (!isProcessAlive(rootPid)) {
+    return [];
+  }
+  if (process.platform === "win32") {
+    return listDescendantPidsWindows(rootPid);
+  }
+  try {
+    const { stdout } = await execFileAsync("ps", ["-eo", "pid=,ppid="]);
+    const children = /* @__PURE__ */ new Map();
+    for (const line of stdout.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) {
+        continue;
+      }
+      const [pidText, ppidText] = trimmed.split(/\s+/, 2);
+      const pid = Number.parseInt(pidText ?? "", 10);
+      const ppid = Number.parseInt(ppidText ?? "", 10);
+      if (!Number.isFinite(pid) || !Number.isFinite(ppid)) {
+        continue;
+      }
+      const bucket = children.get(ppid) ?? [];
+      bucket.push(pid);
+      children.set(ppid, bucket);
+    }
+    return collectDescendantsFromChildren(rootPid, children);
+  } catch {
+    return [];
+  }
+}
+async function listDescendantPidsWindows(rootPid) {
+  try {
+    const powershellScript = "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId | ConvertTo-Json -Compress";
+    const { stdout } = await execFileAsync("powershell.exe", ["-NoProfile", "-Command", powershellScript]);
+    const trimmed = stdout.trim();
+    if (!trimmed) {
+      return [];
+    }
+    const parsed = JSON.parse(trimmed);
+    const entries = Array.isArray(parsed) ? parsed : [parsed];
+    const children = /* @__PURE__ */ new Map();
+    for (const entry of entries) {
+      const pidCandidate = entry?.ProcessId;
+      const ppidCandidate = entry?.ParentProcessId;
+      if (typeof pidCandidate !== "number" || typeof ppidCandidate !== "number") {
+        continue;
+      }
+      const pid = Number.isFinite(pidCandidate) ? pidCandidate : void 0;
+      const ppid = Number.isFinite(ppidCandidate) ? ppidCandidate : void 0;
+      if (pid === void 0 || ppid === void 0) {
+        continue;
+      }
+      const bucket = children.get(ppid) ?? [];
+      bucket.push(pid);
+      children.set(ppid, bucket);
+    }
+    return collectDescendantsFromChildren(rootPid, children);
+  } catch {
+    return [];
+  }
+}
+function execFileAsync(command, args) {
+  return new Promise((resolve, reject) => {
+    execFile(command, args, { encoding: "utf8" }, (error, stdout, stderr) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve({ stdout, stderr });
     });
   });
 }
@@ -782,7 +3260,7 @@ function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/errors.js
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime/errors.js
 var NON_FATAL_MCP_ERROR_CODES = /* @__PURE__ */ new Set([
   ProtocolErrorCode.InvalidRequest,
   ProtocolErrorCode.MethodNotFound,
@@ -804,8 +3282,8 @@ function protocolErrorCode(error) {
   return typeof error.code === "number" ? error.code : void 0;
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/replay-transport.js
-import fs from "node:fs";
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime/replay-transport.js
+import fs5 from "node:fs";
 import { isDeepStrictEqual } from "node:util";
 var CLIENT_IDENTITY_META_KEYS = [
   "io.modelcontextprotocol/clientInfo",
@@ -860,7 +3338,7 @@ var ReplayTransport = class {
 };
 function readRecordedMessages(recordPath) {
   try {
-    const contents = fs.readFileSync(recordPath, "utf8");
+    const contents = fs5.readFileSync(recordPath, "utf8");
     return contents.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0).map((line, index) => {
       try {
         return JSON.parse(line);
@@ -997,44 +3475,250 @@ function adaptInitializeResponse(method, response, requestParams) {
   if (typeof protocolVersion !== "string" || !isJsonRpcRecord(response.result)) {
     return response;
   }
-  return {
-    ...response,
-    result: { ...response.result, protocolVersion }
-  };
-}
-function isJsonRpcRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function withActiveRequestId(response, requestId) {
-  if (requestId === void 0) {
-    return response;
+  return {
+    ...response,
+    result: { ...response.result, protocolVersion }
+  };
+}
+function isJsonRpcRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function withActiveRequestId(response, requestId) {
+  if (requestId === void 0) {
+    return response;
+  }
+  return {
+    ...response,
+    id: requestId
+  };
+}
+function formatReplayMismatch(server, request, expected) {
+  const expectedText = expected ? `${expected.method} ${JSON.stringify(expected.params ?? {})}` : "no remaining recorded recv";
+  return `Replay mismatch for server '${server}': request ${request.method} ${JSON.stringify(request.params ?? {})} did not match next expected recv ${expectedText}.`;
+}
+function formatReplayRemainder(server, expectedSends) {
+  const expected = expectedSends[0];
+  const count = expectedSends.length;
+  const requestText = count === 1 ? "request" : "requests";
+  const expectedText = expected ? `${expected.method} ${JSON.stringify(expected.params ?? {})}` : "no remaining recorded recv";
+  return `Replay ended for server '${server}' with ${count} recorded ${requestText} still unused; next expected recv ${expectedText}.`;
+}
+
+// node_modules/.pnpm/@modelcontextprotocol+client@2.0.0/node_modules/@modelcontextprotocol/client/dist/stdio.mjs
+var import_cross_spawn = __toESM(require_cross_spawn(), 1);
+import process2 from "node:process";
+import { PassThrough } from "node:stream";
+var DEFAULT_INHERITED_ENV_VARS = process2.platform === "win32" ? [
+  "APPDATA",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "LOCALAPPDATA",
+  "PATH",
+  "PROCESSOR_ARCHITECTURE",
+  "SYSTEMDRIVE",
+  "SYSTEMROOT",
+  "TEMP",
+  "USERNAME",
+  "USERPROFILE",
+  "PROGRAMFILES"
+] : [
+  "HOME",
+  "LOGNAME",
+  "PATH",
+  "SHELL",
+  "TERM",
+  "USER"
+];
+function getDefaultEnvironment() {
+  const env = {};
+  for (const key of DEFAULT_INHERITED_ENV_VARS) {
+    const value = process2.env[key];
+    if (value === void 0) continue;
+    if (value.startsWith("()")) continue;
+    env[key] = value;
+  }
+  return env;
+}
+var StdioClientTransport = class {
+  _process;
+  _readBuffer;
+  _serverParams;
+  _stderrStream = null;
+  onclose;
+  onerror;
+  onmessage;
+  constructor(server) {
+    this._serverParams = server;
+    this._readBuffer = new ReadBuffer({ maxBufferSize: server.maxBufferSize });
+    if (server.stderr === "pipe" || server.stderr === "overlapped") this._stderrStream = new PassThrough();
+  }
+  /**
+  * Starts the server process and prepares to communicate with it.
+  */
+  async start() {
+    if (this._process) throw new Error("StdioClientTransport already started! If using Client class, note that connect() calls start() automatically.");
+    return new Promise((resolve, reject) => {
+      this._process = (0, import_cross_spawn.default)(this._serverParams.command, this._serverParams.args ?? [], {
+        env: {
+          ...getDefaultEnvironment(),
+          ...this._serverParams.env
+        },
+        stdio: [
+          "pipe",
+          "pipe",
+          this._serverParams.stderr ?? "inherit"
+        ],
+        shell: false,
+        windowsHide: process2.platform === "win32",
+        cwd: this._serverParams.cwd
+      });
+      this._process.on("error", (error) => {
+        reject(error);
+        this.onerror?.(error);
+      });
+      this._process.on("spawn", () => {
+        resolve();
+      });
+      this._process.on("close", (_code) => {
+        this._process = void 0;
+        this.onclose?.();
+      });
+      this._process.stdin?.on("error", (error) => {
+        this.onerror?.(error);
+      });
+      this._process.stdout?.on("data", (chunk) => {
+        try {
+          this._readBuffer.append(chunk);
+          this.processReadBuffer();
+        } catch (error) {
+          this.onerror?.(error);
+          this.close().catch(() => {
+          });
+        }
+      });
+      this._process.stdout?.on("error", (error) => {
+        this.onerror?.(error);
+      });
+      if (this._stderrStream && this._process.stderr) this._process.stderr.pipe(this._stderrStream);
+    });
+  }
+  /**
+  * The `stderr` stream of the child process, if {@linkcode StdioServerParameters.stderr} was set to `"pipe"` or `"overlapped"`.
+  *
+  * If `stderr` piping was requested, a `PassThrough` stream is returned _immediately_, allowing callers to
+  * attach listeners before the `start` method is invoked. This prevents loss of any early
+  * error output emitted by the child process.
+  */
+  get stderr() {
+    if (this._stderrStream) return this._stderrStream;
+    return this._process?.stderr ?? null;
+  }
+  /**
+  * The child process pid spawned by this transport.
+  *
+  * This is only available after the transport has been started.
+  */
+  get pid() {
+    return this._process?.pid ?? null;
+  }
+  processReadBuffer() {
+    while (true) try {
+      const message = this._readBuffer.readMessage();
+      if (message === null) break;
+      this.onmessage?.(message);
+    } catch (error) {
+      this.onerror?.(error);
+    }
+  }
+  /**
+  * Reap a disposable probe sibling (see the version-negotiation sibling
+  * flow): signal-first teardown awaiting process `exit` — never the `close`
+  * event, so a helper process holding the child's stdio pipes can never
+  * block disposal. Not part of the public transport lifecycle.
+  *
+  * @internal
+  */
+  async _dispose() {
+    const proc = this._process;
+    this._process = void 0;
+    if (proc && proc.exitCode === null && proc.signalCode === null) {
+      const exited = new Promise((resolve) => proc.once("exit", () => resolve()));
+      try {
+        proc.stdin?.end();
+      } catch {
+      }
+      try {
+        proc.kill("SIGTERM");
+      } catch {
+      }
+      await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, 1e3).unref())]);
+      if (proc.exitCode === null && proc.signalCode === null) try {
+        proc.kill("SIGKILL");
+      } catch {
+      }
+      await exited;
+    }
+    try {
+      proc?.stdout?.destroy();
+    } catch {
+    }
+    try {
+      proc?.stdin?.destroy();
+    } catch {
+    }
+    try {
+      proc?.stderr?.destroy();
+    } catch {
+    }
+    this._readBuffer.clear();
+  }
+  async close() {
+    if (this._process) {
+      const processToClose = this._process;
+      this._process = void 0;
+      const closePromise = new Promise((resolve) => {
+        processToClose.once("close", () => {
+          resolve();
+        });
+      });
+      try {
+        processToClose.stdin?.end();
+      } catch {
+      }
+      await Promise.race([closePromise, new Promise((resolve) => setTimeout(resolve, 2e3).unref())]);
+      if (processToClose.exitCode === null) {
+        try {
+          processToClose.kill("SIGTERM");
+        } catch {
+        }
+        await Promise.race([closePromise, new Promise((resolve) => setTimeout(resolve, 2e3).unref())]);
+      }
+      if (processToClose.exitCode === null) try {
+        processToClose.kill("SIGKILL");
+      } catch {
+      }
+    }
+    this._readBuffer.clear();
+  }
+  send(message) {
+    return new Promise((resolve) => {
+      if (!this._process?.stdin) throw new SdkError(SdkErrorCode.NotConnected, "Not connected");
+      const json = serializeMessage(message);
+      if (this._process.stdin.write(json)) resolve();
+      else this._process.stdin.once("drain", resolve);
+    });
   }
-  return {
-    ...response,
-    id: requestId
-  };
-}
-function formatReplayMismatch(server, request, expected) {
-  const expectedText = expected ? `${expected.method} ${JSON.stringify(expected.params ?? {})}` : "no remaining recorded recv";
-  return `Replay mismatch for server '${server}': request ${request.method} ${JSON.stringify(request.params ?? {})} did not match next expected recv ${expectedText}.`;
-}
-function formatReplayRemainder(server, expectedSends) {
-  const expected = expectedSends[0];
-  const count = expectedSends.length;
-  const requestText = count === 1 ? "request" : "requests";
-  const expectedText = expected ? `${expected.method} ${JSON.stringify(expected.params ?? {})}` : "no remaining recorded recv";
-  return `Replay ended for server '${server}' with ${count} recorded ${requestText} still unused; next expected recv ${expectedText}.`;
-}
+};
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/chrome-devtools-compat.js
-import fs3 from "node:fs";
-import os from "node:os";
-import path2 from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-compat.js
+import fs7 from "node:fs";
+import os5 from "node:os";
+import path8 from "node:path";
+import { fileURLToPath, pathToFileURL as pathToFileURL2 } from "node:url";
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/chrome-devtools-auto-connect-patch.js
-import fs2 from "node:fs";
-import path from "node:path";
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-auto-connect-patch.js
+import fs6 from "node:fs";
+import path7 from "node:path";
 var MARKER = "MCPORTER_DEVTOOLS_TIMEOUT_PATCH";
 var HELPER = `// ${MARKER}
 const MCPORTER_DEVTOOLS_DETECTION_TIMEOUT = 1_000;
@@ -1064,7 +3748,7 @@ var PATCHED_DETECTION_BLOCK = `if (await mcporterWithTimeout(page.hasDevTools(),
                 }`;
 patchChromeDevtoolsMcp();
 function patchChromeDevtoolsMcp(mainPath = process.argv[1]) {
-  patchChromeDevtoolsMcpWithDependencies(mainPath, fs2, path, MARKER, HELPER, DETECTION_BLOCK, PATCHED_DETECTION_BLOCK);
+  patchChromeDevtoolsMcpWithDependencies(mainPath, fs6, path7, MARKER, HELPER, DETECTION_BLOCK, PATCHED_DETECTION_BLOCK);
 }
 function renderChromeDevtoolsAutoConnectPatchSource() {
   return `import fs from 'node:fs';
@@ -1119,7 +3803,7 @@ ${helper}`);
   }
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/chrome-devtools-compat.js
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/chrome-devtools-compat.js
 var FALLBACK_PATCH_FILENAME = "mcporter-chrome-devtools-auto-connect-patch.js";
 function applyChromeDevtoolsCompat(env, command, args) {
   if (!shouldApplyChromeDevtoolsCompat(command, args, env)) {
@@ -1129,276 +3813,51 @@ function applyChromeDevtoolsCompat(env, command, args) {
   if (!patchPath) {
     return { env, applied: false };
   }
-  const importFlag = `--import=${pathToFileURL(patchPath).href}`;
+  const importFlag = `--import=${pathToFileURL2(patchPath).href}`;
   const existingOptions = env.NODE_OPTIONS?.trim();
   if (existingOptions?.includes(importFlag)) {
-    return { env, applied: true, patchPath };
-  }
-  return {
-    env: {
-      ...env,
-      NODE_OPTIONS: existingOptions ? `${existingOptions} ${importFlag}` : importFlag
-    },
-    applied: true,
-    patchPath
-  };
-}
-function shouldApplyChromeDevtoolsCompat(command, args, env = process.env) {
-  if (env.MCPORTER_DISABLE_CHROME_DEVTOOLS_COMPAT === "1") {
-    return false;
-  }
-  return resolveChromeDevtoolsAutoConnectCommand(command, args).enabled;
-}
-function resolveChromeDevtoolsCompatPatchPath(candidates = defaultChromeDevtoolsPatchCandidates(), fallbackDir = os.tmpdir()) {
-  const existing = candidates.find((candidate) => fs3.existsSync(candidate));
-  if (existing) {
-    return existing;
-  }
-  return writeFallbackPatch(fallbackDir);
-}
-function defaultChromeDevtoolsPatchCandidates() {
-  const here = path2.dirname(fileURLToPath(import.meta.url));
-  return [
-    path2.join(here, "chrome-devtools-auto-connect-patch.js"),
-    path2.resolve(here, "..", "dist", "chrome-devtools-auto-connect-patch.js")
-  ];
-}
-function writeFallbackPatch(fallbackDir) {
-  const patchPath = path2.join(fallbackDir, FALLBACK_PATCH_FILENAME);
-  try {
-    fs3.writeFileSync(patchPath, renderChromeDevtoolsAutoConnectPatchSource(), { mode: 384 });
-    return patchPath;
-  } catch {
-    return void 0;
-  }
-}
-
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/chrome-devtools-relay-handoff.js
-import { spawnSync } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import fs4 from "node:fs";
-import os2 from "node:os";
-import path3 from "node:path";
-import { pathToFileURL as pathToFileURL2 } from "node:url";
-var CHROME_RELAY_HANDOFF_ENV = "MCPORTER_CHROME_RELAY_HANDOFF_PATH";
-var HANDOFF_DIR_PREFIX = "mcporter-chrome-relay-";
-var HANDOFF_FILENAME = "headers.json";
-var PRELOAD_FILENAME = "preload.mjs";
-var WINDOWS_ACL_PATH_ENV = "MCPORTER_CHROME_RELAY_ACL_PATH";
-function createChromeDevtoolsRelayHandoff(env, clientAuthorization) {
-  let directory;
-  try {
-    if (process.platform === "win32")
-      directory = createWindowsHandoffDirectory();
-    else {
-      directory = fs4.mkdtempSync(path3.join(os2.tmpdir(), HANDOFF_DIR_PREFIX));
-      fs4.chmodSync(directory, 448);
-    }
-    assertSecurePath(directory, "directory");
-    const handoffPath = path3.join(directory, HANDOFF_FILENAME);
-    const preloadPath = path3.join(directory, PRELOAD_FILENAME);
-    writeExclusiveFile(preloadPath, renderChromeDevtoolsRelayPreloadSource());
-    writeExclusiveFile(handoffPath, JSON.stringify({ Authorization: clientAuthorization }));
-    const importFlag = `--import=${pathToFileURL2(preloadPath).href}`;
-    const existingOptions = env.NODE_OPTIONS?.trim();
-    let closed = false;
-    return {
-      env: {
-        ...env,
-        NODE_OPTIONS: existingOptions ? `${existingOptions} ${importFlag}` : importFlag,
-        [CHROME_RELAY_HANDOFF_ENV]: handoffPath
-      },
-      handoffPath,
-      preloadPath,
-      async close() {
-        if (closed)
-          return;
-        closed = true;
-        cleanupHandoff(directory, handoffPath, preloadPath);
-      }
-    };
-  } catch (error) {
-    if (directory)
-      cleanupHandoff(directory, path3.join(directory, HANDOFF_FILENAME), path3.join(directory, PRELOAD_FILENAME));
-    const diagnostic = error instanceof Error && error.message.startsWith("Windows ACL setup failed:") ? ` ${error.message}` : "";
-    throw new Error(`Unable to install secure Chrome relay authorization handoff.${diagnostic}`, { cause: error });
-  }
-}
-function createWindowsHandoffDirectory() {
-  const directory = path3.join(os2.tmpdir(), `${HANDOFF_DIR_PREFIX}${randomBytes(16).toString("hex")}`);
-  const script = String.raw`
-$ErrorActionPreference = 'Stop'
-$stage = 'identity'
-try {
-$target = $env:${WINDOWS_ACL_PATH_ENV}
-if ([System.IO.Directory]::Exists($target)) { throw 'handoff path already exists' }
-$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
-$stage = 'descriptor'
-$security = New-Object System.Security.AccessControl.DirectorySecurity
-$sidValue = $sid.Value
-$security.SetSecurityDescriptorSddlForm("O:$($sidValue)G:$($sidValue)D:P(A;OICI;FA;;;$($sidValue))")
-$directory = New-Object System.IO.DirectoryInfo -ArgumentList @($target)
-$stage = 'create'
-$directory.Create($security)
-$stage = 'acl-read'
-$check = $directory.GetAccessControl([System.Security.AccessControl.AccessControlSections]::All)
-$rules = @($check.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
-$ownerSid = $check.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
-$stage = 'acl-verify'
-if (-not $check.AreAccessRulesProtected -or $ownerSid -ne $sid.Value -or $rules.Count -ne 1) { throw 'unsafe ACL' }
-$ruleSid = $rules[0].IdentityReference.Value
-$hasFullControl = ($rules[0].FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl
-if ($ruleSid -ne $sid.Value -or $rules[0].IsInherited -or -not $hasFullControl -or $rules[0].AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { throw 'unsafe ACL' }
-} catch {
-  $type = $_.Exception.GetType().FullName
-  $hresult = ('0x{0:X8}' -f ($_.Exception.HResult -band 0xffffffffL))
-  [Console]::Error.WriteLine("stage=$stage type=$type hresult=$hresult")
-  exit 1
-}
-`;
-  const result = spawnSync(resolveSystemPowerShellPath(), ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
-    encoding: "utf8",
-    env: { ...process.env, [WINDOWS_ACL_PATH_ENV]: directory },
-    stdio: ["ignore", "ignore", "pipe"],
-    windowsHide: true
-  });
-  if (result.status !== 0) {
-    try {
-      fs4.rmdirSync(directory);
-    } catch {
-    }
-    const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
-    const safeDetail = /^[A-Za-z0-9_.:=\- ]{1,240}$/u.test(stderr) ? stderr : `stage=spawn type=${result.error?.code ?? "unknown"} hresult=unknown`;
-    throw new Error(`Windows ACL setup failed: ${safeDetail}`);
-  }
-  return directory;
-}
-function resolveSystemPowerShellPath() {
-  const systemRoot = process.env.SystemRoot?.trim() || process.env.WINDIR?.trim();
-  if (!systemRoot || !path3.win32.isAbsolute(systemRoot))
-    throw new Error("unsafe Windows system root");
-  const executable = path3.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-  const stat = fs4.lstatSync(executable);
-  if (!stat.isFile() || stat.isSymbolicLink())
-    throw new Error("unsafe Windows PowerShell path");
-  return executable;
-}
-function writeExclusiveFile(filePath, contents) {
-  const descriptor = fs4.openSync(filePath, fs4.constants.O_WRONLY | fs4.constants.O_CREAT | fs4.constants.O_EXCL | (fs4.constants.O_NOFOLLOW ?? 0), 384);
-  try {
-    if (process.platform !== "win32")
-      fs4.fchmodSync(descriptor, 384);
-    fs4.writeFileSync(descriptor, contents, "utf8");
-  } finally {
-    fs4.closeSync(descriptor);
-  }
-  assertSecurePath(filePath, "file");
-}
-function assertSecurePath(filePath, kind) {
-  const stat = fs4.lstatSync(filePath);
-  if ((kind === "directory" ? !stat.isDirectory() : !stat.isFile()) || stat.isSymbolicLink())
-    throw new Error("unsafe");
-  if (process.platform === "win32")
-    return;
-  if ((stat.mode & 63) !== 0)
-    throw new Error("unsafe");
-  if (typeof process.getuid === "function" && stat.uid !== process.getuid())
-    throw new Error("unsafe");
-}
-function cleanupHandoff(directory, handoffPath, preloadPath) {
-  for (const filePath of [handoffPath, preloadPath]) {
-    try {
-      fs4.unlinkSync(filePath);
-    } catch {
-    }
-  }
-  try {
-    fs4.rmdirSync(directory);
-  } catch {
-  }
-}
-function renderChromeDevtoolsRelayPreloadSource() {
-  return `import fs from 'node:fs';
-import path from 'node:path';
-
-const targetPath = process.argv[1]?.replaceAll('\\\\', '/').toLowerCase();
-if (targetPath?.includes('chrome-devtools-mcp')) {
-  const failureMessage = 'MCPorter Chrome relay authorization handoff unavailable.';
-  const fail = () => {
-    throw new Error(failureMessage);
-  };
-  const envName = ${JSON.stringify(CHROME_RELAY_HANDOFF_ENV)};
-  const handoffPath = process.env[envName];
-  delete process.env[envName];
-  if (!handoffPath || !path.isAbsolute(handoffPath)) fail();
-
-  const directoryStat = (() => {
-    try {
-      return fs.lstatSync(path.dirname(handoffPath));
-    } catch {
-      return fail();
-    }
-  })();
-  if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) fail();
-  if (process.platform !== 'win32') {
-    if ((directoryStat.mode & 0o077) !== 0) fail();
-    if (typeof process.getuid === 'function' && directoryStat.uid !== process.getuid()) fail();
-  }
-
-  const descriptor = (() => {
-    try {
-      return fs.openSync(handoffPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
-    } catch {
-      return fail();
-    }
-  })();
-
-  let raw = '';
-  let consumed = false;
-  try {
-    const stat = fs.fstatSync(descriptor);
-    if (!stat.isFile() || stat.size <= 0 || stat.size > 4_096) fail();
-    if (process.platform !== 'win32') {
-      if ((stat.mode & 0o077) !== 0) fail();
-      if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) fail();
-    }
-    raw = fs.readFileSync(descriptor, 'utf8');
-    try {
-      fs.unlinkSync(handoffPath);
-      consumed = true;
-    } catch {
-      try {
-        fs.ftruncateSync(descriptor, 0);
-        consumed = true;
-      } catch {
-        fail();
-      }
-    }
-  } finally {
-    fs.closeSync(descriptor);
+    return { env, applied: true, patchPath };
   }
-  if (!consumed) fail();
-
-  let parsed;
+  return {
+    env: {
+      ...env,
+      NODE_OPTIONS: existingOptions ? `${existingOptions} ${importFlag}` : importFlag
+    },
+    applied: true,
+    patchPath
+  };
+}
+function shouldApplyChromeDevtoolsCompat(command, args, env = process.env) {
+  if (env.MCPORTER_DISABLE_CHROME_DEVTOOLS_COMPAT === "1") {
+    return false;
+  }
+  return resolveChromeDevtoolsAutoConnectCommand(command, args).enabled;
+}
+function resolveChromeDevtoolsCompatPatchPath(candidates = defaultChromeDevtoolsPatchCandidates(), fallbackDir = os5.tmpdir()) {
+  const existing = candidates.find((candidate) => fs7.existsSync(candidate));
+  if (existing) {
+    return existing;
+  }
+  return writeFallbackPatch(fallbackDir);
+}
+function defaultChromeDevtoolsPatchCandidates() {
+  const here = path8.dirname(fileURLToPath(import.meta.url));
+  return [
+    path8.join(here, "chrome-devtools-auto-connect-patch.js"),
+    path8.resolve(here, "..", "dist", "chrome-devtools-auto-connect-patch.js")
+  ];
+}
+function writeFallbackPatch(fallbackDir) {
+  const patchPath = path8.join(fallbackDir, FALLBACK_PATCH_FILENAME);
   try {
-    parsed = JSON.parse(raw);
+    fs7.writeFileSync(patchPath, renderChromeDevtoolsAutoConnectPatchSource(), { mode: 384 });
+    return patchPath;
   } catch {
-    fail();
+    return void 0;
   }
-  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) fail();
-  const entries = Object.entries(parsed);
-  if (entries.length !== 1 || entries[0]?.[0] !== 'Authorization') fail();
-  const authorization = entries[0]?.[1];
-  if (typeof authorization !== 'string' || !/^Bearer [A-Za-z0-9_-]{43}$/u.test(authorization)) fail();
-
-  const terminatorIndex = process.argv.indexOf('--', 2);
-  const insertionIndex = terminatorIndex >= 0 ? terminatorIndex : process.argv.length;
-  process.argv.splice(insertionIndex, 0, '--wsHeaders', JSON.stringify({ Authorization: authorization }));
-}
-`;
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/cached-auth.js
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime/cached-auth.js
 function hasAuthorizationHeader(headers) {
   return Boolean(headers && Object.keys(headers).some((key) => key.toLowerCase() === "authorization"));
 }
@@ -1461,15 +3920,15 @@ async function applyCachedAuthIfAvailable(definition, logger, allowCachedAuth) {
   }
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime-header-utils.js
-function materializeHeaders(headers, serverName) {
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime-header-utils.js
+function materializeHeaders(headers, serverName, env = process.env) {
   if (!headers) {
     return void 0;
   }
   const resolved = {};
   for (const [key, value] of Object.entries(headers)) {
     try {
-      resolved[key] = resolveEnvPlaceholders(value);
+      resolved[key] = resolveEnvPlaceholders(value, env);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       throw new Error(`Failed to resolve header '${key}' for server '${serverName}': ${message}`, { cause: error });
@@ -1478,8 +3937,8 @@ function materializeHeaders(headers, serverName) {
   return resolved;
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/node-http-fetch.js
-import http from "node:http";
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime/node-http-fetch.js
+import http2 from "node:http";
 import https from "node:https";
 import { Buffer as Buffer2 } from "node:buffer";
 import { Readable } from "node:stream";
@@ -1517,7 +3976,7 @@ async function nodeHttp1FetchWithRedirects(input, init, redirectCount) {
     headers["content-length"] = String(Buffer2.byteLength(body));
   }
   return new Promise((resolve, reject) => {
-    const client = url.protocol === "https:" ? https : http;
+    const client = url.protocol === "https:" ? https : http2;
     const request = client.request(url, {
       method: init.method ?? "GET",
       headers
@@ -1637,7 +4096,7 @@ async function materializeRequestBody(body) {
   throw new TypeError("node-http1 fetch does not support streaming request bodies.");
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/http-transport.js
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime/http-transport.js
 function extractTransportStatusCode(error) {
   if (!error || typeof error !== "object")
     return void 0;
@@ -1688,7 +4147,7 @@ function createHttpTransportOptions(definition, oauthSession, shouldEstablishOAu
   const command = definition.command;
   if (command.kind !== "http")
     throw new Error(`Server '${definition.name}' is not configured for HTTP transport.`);
-  const resolvedHeaders = materializeHeaders(command.headers, definition.name);
+  const resolvedHeaders = materializeHeaders(command.headers, definition.name, definition.env);
   const effectiveHeaders = shouldEstablishOAuth ? removeAuthorizationHeader(resolvedHeaders) : resolvedHeaders;
   const trackedFetch = trackStandaloneSseFetch(resolveHttpFetchOverride(definition));
   return {
@@ -1763,8 +4222,7 @@ async function connectHttpTransport(client, transport, oauthSession, logger, con
     return await connectWithAuth(client, transport, oauthSession, logger, connectOptions);
   } catch (error) {
     if (!connectOptions.signal?.aborted) {
-      await closeTransportAndWait(logger, transport).catch(() => {
-      });
+      await closeTransportAndWait(logger, transport, { throwOnCloseError: true, requireRetirement: true });
     }
     throw error;
   }
@@ -1861,213 +4319,7 @@ async function connectSseFallbackTransport(client, definition, command, transpor
   }
 }
 
-// node_modules/.pnpm/@modelcontextprotocol+client@2.0.0/node_modules/@modelcontextprotocol/client/dist/stdio.mjs
-var import_cross_spawn = __toESM(require_cross_spawn(), 1);
-import process2 from "node:process";
-import { PassThrough } from "node:stream";
-var DEFAULT_INHERITED_ENV_VARS = process2.platform === "win32" ? [
-  "APPDATA",
-  "HOMEDRIVE",
-  "HOMEPATH",
-  "LOCALAPPDATA",
-  "PATH",
-  "PROCESSOR_ARCHITECTURE",
-  "SYSTEMDRIVE",
-  "SYSTEMROOT",
-  "TEMP",
-  "USERNAME",
-  "USERPROFILE",
-  "PROGRAMFILES"
-] : [
-  "HOME",
-  "LOGNAME",
-  "PATH",
-  "SHELL",
-  "TERM",
-  "USER"
-];
-function getDefaultEnvironment() {
-  const env = {};
-  for (const key of DEFAULT_INHERITED_ENV_VARS) {
-    const value = process2.env[key];
-    if (value === void 0) continue;
-    if (value.startsWith("()")) continue;
-    env[key] = value;
-  }
-  return env;
-}
-var StdioClientTransport = class {
-  _process;
-  _readBuffer;
-  _serverParams;
-  _stderrStream = null;
-  onclose;
-  onerror;
-  onmessage;
-  constructor(server) {
-    this._serverParams = server;
-    this._readBuffer = new ReadBuffer({ maxBufferSize: server.maxBufferSize });
-    if (server.stderr === "pipe" || server.stderr === "overlapped") this._stderrStream = new PassThrough();
-  }
-  /**
-  * Starts the server process and prepares to communicate with it.
-  */
-  async start() {
-    if (this._process) throw new Error("StdioClientTransport already started! If using Client class, note that connect() calls start() automatically.");
-    return new Promise((resolve, reject) => {
-      this._process = (0, import_cross_spawn.default)(this._serverParams.command, this._serverParams.args ?? [], {
-        env: {
-          ...getDefaultEnvironment(),
-          ...this._serverParams.env
-        },
-        stdio: [
-          "pipe",
-          "pipe",
-          this._serverParams.stderr ?? "inherit"
-        ],
-        shell: false,
-        windowsHide: process2.platform === "win32",
-        cwd: this._serverParams.cwd
-      });
-      this._process.on("error", (error) => {
-        reject(error);
-        this.onerror?.(error);
-      });
-      this._process.on("spawn", () => {
-        resolve();
-      });
-      this._process.on("close", (_code) => {
-        this._process = void 0;
-        this.onclose?.();
-      });
-      this._process.stdin?.on("error", (error) => {
-        this.onerror?.(error);
-      });
-      this._process.stdout?.on("data", (chunk) => {
-        try {
-          this._readBuffer.append(chunk);
-          this.processReadBuffer();
-        } catch (error) {
-          this.onerror?.(error);
-          this.close().catch(() => {
-          });
-        }
-      });
-      this._process.stdout?.on("error", (error) => {
-        this.onerror?.(error);
-      });
-      if (this._stderrStream && this._process.stderr) this._process.stderr.pipe(this._stderrStream);
-    });
-  }
-  /**
-  * The `stderr` stream of the child process, if {@linkcode StdioServerParameters.stderr} was set to `"pipe"` or `"overlapped"`.
-  *
-  * If `stderr` piping was requested, a `PassThrough` stream is returned _immediately_, allowing callers to
-  * attach listeners before the `start` method is invoked. This prevents loss of any early
-  * error output emitted by the child process.
-  */
-  get stderr() {
-    if (this._stderrStream) return this._stderrStream;
-    return this._process?.stderr ?? null;
-  }
-  /**
-  * The child process pid spawned by this transport.
-  *
-  * This is only available after the transport has been started.
-  */
-  get pid() {
-    return this._process?.pid ?? null;
-  }
-  processReadBuffer() {
-    while (true) try {
-      const message = this._readBuffer.readMessage();
-      if (message === null) break;
-      this.onmessage?.(message);
-    } catch (error) {
-      this.onerror?.(error);
-    }
-  }
-  /**
-  * Reap a disposable probe sibling (see the version-negotiation sibling
-  * flow): signal-first teardown awaiting process `exit` — never the `close`
-  * event, so a helper process holding the child's stdio pipes can never
-  * block disposal. Not part of the public transport lifecycle.
-  *
-  * @internal
-  */
-  async _dispose() {
-    const proc = this._process;
-    this._process = void 0;
-    if (proc && proc.exitCode === null && proc.signalCode === null) {
-      const exited = new Promise((resolve) => proc.once("exit", () => resolve()));
-      try {
-        proc.stdin?.end();
-      } catch {
-      }
-      try {
-        proc.kill("SIGTERM");
-      } catch {
-      }
-      await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, 1e3).unref())]);
-      if (proc.exitCode === null && proc.signalCode === null) try {
-        proc.kill("SIGKILL");
-      } catch {
-      }
-      await exited;
-    }
-    try {
-      proc?.stdout?.destroy();
-    } catch {
-    }
-    try {
-      proc?.stdin?.destroy();
-    } catch {
-    }
-    try {
-      proc?.stderr?.destroy();
-    } catch {
-    }
-    this._readBuffer.clear();
-  }
-  async close() {
-    if (this._process) {
-      const processToClose = this._process;
-      this._process = void 0;
-      const closePromise = new Promise((resolve) => {
-        processToClose.once("close", () => {
-          resolve();
-        });
-      });
-      try {
-        processToClose.stdin?.end();
-      } catch {
-      }
-      await Promise.race([closePromise, new Promise((resolve) => setTimeout(resolve, 2e3).unref())]);
-      if (processToClose.exitCode === null) {
-        try {
-          processToClose.kill("SIGTERM");
-        } catch {
-        }
-        await Promise.race([closePromise, new Promise((resolve) => setTimeout(resolve, 2e3).unref())]);
-      }
-      if (processToClose.exitCode === null) try {
-        processToClose.kill("SIGKILL");
-      } catch {
-      }
-    }
-    this._readBuffer.clear();
-  }
-  send(message) {
-    return new Promise((resolve) => {
-      if (!this._process?.stdin) throw new SdkError(SdkErrorCode.NotConnected, "Not connected");
-      const json = serializeMessage(message);
-      if (this._process.stdin.write(json)) resolve();
-      else this._process.stdin.once("drain", resolve);
-    });
-  }
-};
-
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/stdio-transport.js
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime/stdio-transport.js
 var McporterStdioTransport = class extends StdioClientTransport {
   parameters;
   meta;
@@ -2081,7 +4333,7 @@ var McporterStdioTransport = class extends StdioClientTransport {
     this.closeDelegate?.();
   };
   messageInterceptor = (message) => {
-    if (STDIO_TRACE_ENABLED)
+    if (STDIO_TRACE_ENABLED && !this.parameters.redactDiagnostics)
       this.meta.stdoutChunks?.push(JSON.stringify(message));
     this.messageDelegate?.(message);
   };
@@ -2101,7 +4353,8 @@ var McporterStdioTransport = class extends StdioClientTransport {
     if (stderr) {
       stderr.setEncoding?.("utf8");
       const handleChunk = (chunk) => {
-        this.meta.stderrChunks.push(Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk));
+        if (!this.parameters.redactDiagnostics)
+          this.meta.stderrChunks.push(Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk));
       };
       stderr.on("data", handleChunk);
       stderr.on("error", ignoreStdioEmitterError);
@@ -2109,17 +4362,17 @@ var McporterStdioTransport = class extends StdioClientTransport {
     }
   }
   async start() {
-    if (STDIO_TRACE_ENABLED)
+    if (STDIO_TRACE_ENABLED && !this.parameters.redactDiagnostics)
       console.log("[mcporter] STDIO trace: start() invoked for stdio transport.");
     this.installInterceptors();
     await super.start();
-    if (STDIO_TRACE_ENABLED) {
+    if (STDIO_TRACE_ENABLED && !this.parameters.redactDiagnostics) {
       console.log(`[mcporter] STDIO trace: spawned ${this.meta.command ?? "stdio server"} (pid=${this.pid ?? "unknown"}).`);
     }
   }
   async send(message) {
     this.installInterceptors();
-    if (STDIO_TRACE_ENABLED)
+    if (STDIO_TRACE_ENABLED && !this.parameters.redactDiagnostics)
       this.meta.stdinChunks?.push(JSON.stringify(message));
     await super.send(message);
   }
@@ -2151,7 +4404,7 @@ var McporterStdioTransport = class extends StdioClientTransport {
   }
 };
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/transport.js
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime/transport.js
 function shouldUseModeForServer(definition, serverFilter) {
   return !serverFilter || serverFilter === definition.name;
 }
@@ -2212,9 +4465,16 @@ async function createReplayClientContext(definition, replayPath, clientInfo, opt
   return { client, transport, definition, oauthSession: void 0 };
 }
 async function createStdioClientContext(client, definition, logger, options) {
-  const mergedEnv = resolveChromeDevtoolsRelayEnvironment(definition.env);
-  const command = resolveCommandArgument(definition.command.command);
-  const resolvedArgs = resolveCommandArguments(definition.command.args);
+  const mergedEnv = {
+    ...Object.fromEntries(DEFAULT_INHERITED_ENV_VARS.map((key) => [key, void 0])),
+    ...definition.env
+  };
+  if (isBrokerDefinition(definition) && isChromeDefinition(definition) && resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, definition.env) !== "off") {
+    mergedEnv.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY = "require";
+    delete mergedEnv.MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY;
+  }
+  const command = resolveCommandArgument(definition.command.command, mergedEnv);
+  const resolvedArgs = resolveCommandArguments(definition.command.args, mergedEnv);
   const publishRelayDecision = (decision) => {
     if (decision.reason === "not-eligible")
       return;
@@ -2224,7 +4484,7 @@ async function createStdioClientContext(client, definition, logger, options) {
   let relayDecision;
   let relay;
   try {
-    relay = await rewriteChromeDevtoolsArgsForRelay(command, resolvedArgs, mergedEnv, { onDecision: (decision) => relayDecision = decision }, definition.chromeDevtoolsRelay);
+    relay = await rewriteChromeDevtoolsArgsForRelay(command, resolvedArgs, mergedEnv, { onDecision: (decision) => relayDecision = decision }, isBrokerDefinition(definition) && isChromeDefinition(definition) && resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, definition.env) !== "off" ? "require" : definition.chromeDevtoolsRelay);
   } catch (error) {
     if (relayDecision)
       publishRelayDecision(relayDecision);
@@ -2266,6 +4526,7 @@ async function createStdioClientContext(client, definition, logger, options) {
       args: commandArgs,
       cwd: definition.command.cwd,
       env: compat.env,
+      redactDiagnostics: isBrokerDefinition(definition),
       cleanup: activeProxy ? async () => {
         await handoff?.close();
         await activeProxy?.close();
@@ -2282,15 +4543,13 @@ async function createStdioClientContext(client, definition, logger, options) {
   try {
     transport = wrapRecordTransport(rawTransport, definition, options);
   } catch (error) {
-    await closeTransportAndWait(logger, rawTransport).catch(() => {
-    });
+    await closeTransportAndWait(logger, rawTransport, { throwOnCloseError: true, requireRetirement: true });
     throw error;
   }
   try {
     await client.connect(transport, { signal: options.signal });
   } catch (error) {
-    await closeTransportAndWait(logger, transport).catch(() => {
-    });
+    await closeTransportAndWait(logger, transport, { throwOnCloseError: true, requireRetirement: true });
     throw error;
   }
   return { client, transport, definition, oauthSession: void 0 };
@@ -2299,8 +4558,10 @@ async function createClientContext(definition, logger, clientInfo, options = {})
   if (options.replayPath && shouldUseModeForServer(definition, process.env.MCPORTER_REPLAY_SERVER)) {
     return createReplayClientContext(definition, options.replayPath, clientInfo, options);
   }
-  const activeDefinition = await applyCachedAuthIfAvailable(definition, logger, options.allowCachedAuth);
-  return withEnvOverrides(activeDefinition.env, async () => {
+  assertChromeBrokerAuthority(definition);
+  const env = isBrokerDefinition(definition) ? definition.env : resolveChromeDevtoolsRelayEnvironment(definition.env);
+  return withRuntimeEnvironment(env ?? {}, async () => {
+    const activeDefinition = await applyCachedAuthIfAvailable({ ...definition, env }, logger, options.allowCachedAuth);
     if (activeDefinition.command.kind === "stdio") {
       const stdioDefinition = activeDefinition;
       try {
@@ -2327,7 +4588,7 @@ async function createClientContext(definition, logger, clientInfo, options = {})
   });
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/connection-cache.js
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime/connection-cache.js
 var RuntimeConnectionCache = class {
   definitions;
   options;
@@ -2704,11 +4965,12 @@ var RuntimeConnectionCache = class {
     }
   }
   async closeContext(context) {
-    const propagateReplayCloseErrors = context.transport instanceof ReplayTransport;
+    const propagateReplayCloseErrors = context.transport instanceof ReplayTransport || isBrokerDefinition(context.definition);
     let closeError;
     try {
       await closeTransportAndWait(this.logger, context.transport, {
         throwOnCloseError: propagateReplayCloseErrors,
+        requireRetirement: isBrokerDefinition(context.definition),
         close: async () => {
           let firstError;
           const clientClose = context.client.close;
@@ -2741,7 +5003,7 @@ var RuntimeConnectionCache = class {
     }
   }
   async resetConnectionOnError(server, error, failedContext) {
-    if (!shouldResetConnection(error)) {
+    if (isBrokerDefinition(this.definitions.get(server.trim())) || !shouldResetConnection(error)) {
       return;
     }
     const normalized = server.trim();
@@ -2880,7 +5142,7 @@ function connectionInfoFromClient(client) {
   };
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/tool-filters.js
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/tool-filters.js
 function validateToolFilters(name, filter) {
   if (filter.allowedTools !== void 0 && filter.blockedTools !== void 0) {
     throw new Error(`Server '${name}' cannot specify both allowedTools and blockedTools.`);
@@ -2902,7 +5164,7 @@ function filterTools(tools, filter) {
   return tools.filter((tool) => isToolAllowed(tool.name, filter));
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime.js
+// node_modules/.pnpm/mcporter@0.13.10/node_modules/mcporter/dist/runtime.js
 var PACKAGE_NAME = "mcporter";
 var OAUTH_CODE_TIMEOUT_MS = resolveOAuthTimeoutFromEnv();
 var MAX_RESOURCE_LIST_PAGES = 100;
@@ -2929,6 +5191,7 @@ var McpRuntime = class {
   definitions;
   connectionCache;
   logger;
+  clientInfo;
   constructor(servers, options = {}) {
     for (const server of servers) {
       validateToolFilters(server.name, server);
@@ -2939,6 +5202,7 @@ var McpRuntime = class {
       name: PACKAGE_NAME,
       version: MCPORTER_VERSION
     };
+    this.clientInfo = clientInfo;
     const recordSession = process.env.MCPORTER_RECORD;
     const replaySession = process.env.MCPORTER_REPLAY;
     if (recordSession && replaySession) {
@@ -2964,6 +5228,9 @@ var McpRuntime = class {
       elicitationHandler: options.elicitationHandler ?? defaultResponder.handler
     });
   }
+  getClientInfo() {
+    return { ...this.clientInfo };
+  }
   // listServers returns configured names sorted alphabetically for stable CLI output.
   listServers() {
     return [...this.definitions.keys()].toSorted((a, b) => a.localeCompare(b));
@@ -3013,6 +5280,7 @@ var McpRuntime = class {
     let closeError;
     let tools = [];
     try {
+      await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
       const listPromise = context.client.listTools(void 0, timeoutMs ? { timeout: timeoutMs, resetTimeoutOnProgress: true, maxTotalTimeout: timeoutMs } : void 0);
       const response = timeoutMs ? await raceWithTimeout(listPromise, timeoutMs) : await listPromise;
       tools = (response.tools ?? []).map((tool) => ({
@@ -3057,6 +5325,7 @@ var McpRuntime = class {
         arguments: options.args ?? {}
       };
       const timeoutMs = normalizeTimeout(options.timeoutMs);
+      await validateBrokerRequestAuthority(definition);
       const resultPromise = client.callTool(params, {
         timeout: timeoutMs,
         // Long runs (e.g., GPT-5 Pro) emit progress/logging; allow that to refresh the timer.
@@ -3086,8 +5355,10 @@ var McpRuntime = class {
       const { client } = context;
       const requestParams = params;
       if (requestParams.cursor !== void 0) {
+        await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
         return await client.listResources(requestParams);
       }
+      await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
       let response = await client.request({ method: "resources/list", params: requestParams }, specTypeSchemas.ListResourcesResult);
       const resources = [...response.resources];
       const seenCursors = /* @__PURE__ */ new Set();
@@ -3095,6 +5366,7 @@ var McpRuntime = class {
         if (seenCursors.has(response.nextCursor))
           break;
         seenCursors.add(response.nextCursor);
+        await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
         response = await client.request({ method: "resources/list", params: { ...requestParams, cursor: response.nextCursor } }, specTypeSchemas.ListResourcesResult);
         resources.push(...response.resources);
       }
@@ -3114,6 +5386,7 @@ var McpRuntime = class {
         disableOAuth: effectiveDisableOAuth
       });
       const { client } = context;
+      await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
       return await client.readResource({ uri });
     } catch (error) {
       await this.resetConnectionOnError(server, error, context);
@@ -3144,6 +5417,23 @@ function createConsoleLogger(level = resolveLogLevelFromEnv()) {
 }
 
 export {
+  getChromeDevtoolsRelayDecision,
+  effectiveDefinition,
+  connectionIdentity,
+  isChromeDefinition,
+  resolveSystemPowerShellPath,
+  daemonRunDir,
+  secureDaemonDirectory,
+  inspectLegacyDaemonDirectory,
+  upgradeLegacyDaemonDirectory,
+  getDaemonMetadataPath,
+  getDaemonSocketPath,
+  getDaemonLogPath,
+  canonicalUserConfiguration,
+  BrowserOwner,
+  authorizeBrokerDefinition,
+  isToolAllowed,
+  filterTools,
   createRuntime,
   callOnce
 };