@introspection-ai/recipes 0.25.1 → 0.27.1

package/dist/mcp-chunks/{chunk-GQ6NSIDS.js → chunk-PJCMJ65D.js}

@@ -1,43 +1,79 @@
 import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  stableJsonStringify
+} from "./chunk-KQCLM7R7.js";
 import {
   NON_INTERACTIVE_ELICITATION_HINT,
   createNonInteractiveElicitationResponder,
   registerElicitationHandler
-} from "./chunk-ZOAQDFAO.js";
+} from "./chunk-D6B2M5V7.js";
 import {
   RecordTransport,
   resolveRecordingPath
-} from "./chunk-OP3IW2V6.js";
+} from "./chunk-L6OOGZVA.js";
 import {
   OAuthTimeoutError,
   connectWithAuth,
   createOAuthSession,
   isOAuthFlowError,
   isPostAuthConnectError,
+  isUnauthorizedError,
+  maybeEnableOAuth,
   resolveOAuthTimeoutFromEnv
-} from "./chunk-YIRGLKDA.js";
+} from "./chunk-TYYSBILI.js";
 import {
   readCachedAccessToken
-} from "./chunk-ASG4OY3M.js";
+} from "./chunk-IF6LRV3J.js";
 import {
-  isUnauthorizedError,
-  maybeEnableOAuth
-} from "./chunk-IRTJXFWA.js";
+  withRuntimeEnvironment
+} from "./chunk-XNHGMWN2.js";
+import {
+  createPrefixedConsoleLogger,
+  resolveLogLevelFromEnv
+} from "./chunk-P463YBJM.js";
 import {
   STDIO_TRACE_ENABLED,
   flushStdioLogs,
   ignoreStdioEmitterError
-} from "./chunk-EMSNQHZZ.js";
+} from "./chunk-FONFU4G5.js";
 import {
   MCPORTER_VERSION
-} from "./chunk-OD3MSMXY.js";
+} from "./chunk-7PFJCLXL.js";
 import {
-  createPrefixedConsoleLogger,
-  resolveLogLevelFromEnv
-} from "./chunk-7WOKCV6Q.js";
+  ChromeDevtoolsRelayDiscoveryError,
+  ChromeDevtoolsRelayRequiredError,
+  chromeDevtoolsRelayEnvironmentKeys,
+  formatChromeDevtoolsRelayDecision,
+  isExistingChromeDevtoolsCommand,
+  normalizeTimeout,
+  raceWithTimeout,
+  recordChromeDevtoolsRelayDecision,
+  resolveChromeDevtoolsAutoConnectCommand,
+  resolveChromeDevtoolsRelayEnvironment,
+  resolveChromeDevtoolsRelayPolicy,
+  resolveChromeDevtoolsRelayProbeTimeoutMs,
+  resolveChromeDevtoolsRelayRuntimeIdentity,
+  resolveCommandArgument,
+  resolveCommandArguments,
+  rewriteChromeDevtoolsArgsForRelay
+} from "./chunk-H4KL74PV.js";
+import {
+  loadServerDefinitions,
+  normalizeServerEntry,
+  readConfigFile
+} from "./chunk-RZIJUJGL.js";
+import {
+  pathExists
+} from "./chunk-UYJZJXC2.js";
+import {
+  mcporterConfigCandidates
+} from "./chunk-UHO6KIUJ.js";
+import {
+  resolveEnvPlaceholders
+} from "./chunk-D6SVCPN6.js";
 import {
   analyzeConnectionError
-} from "./chunk-QZUC2T72.js";
+} from "./chunk-O4JIUOWF.js";
 import {
   Client,
   DEFAULT_REQUEST_TIMEOUT_MSEC,
@@ -50,28 +86,7 @@ import {
   StreamableHTTPClientTransport,
   serializeMessage,
   specTypeSchemas
-} from "./chunk-PZ323CXI.js";
-import {
-  ChromeDevtoolsRelayRequiredError,
-  formatChromeDevtoolsRelayDecision,
-  recordChromeDevtoolsRelayDecision,
-  resolveChromeDevtoolsAutoConnectCommand,
-  resolveChromeDevtoolsRelayEnvironment,
-  rewriteChromeDevtoolsArgsForRelay
-} from "./chunk-BWW4XRUC.js";
-import {
-  normalizeTimeout,
-  raceWithTimeout,
-  resolveCommandArgument,
-  resolveCommandArguments
-} from "./chunk-I5GI2A2D.js";
-import {
-  loadServerDefinitions
-} from "./chunk-RD7NHCRK.js";
-import {
-  resolveEnvPlaceholders,
-  withEnvOverrides
-} from "./chunk-WTMJMM3B.js";
+} from "./chunk-S5F3HEZZ.js";
 import {
   __commonJS,
   __require,
@@ -83,8 +98,8 @@ var require_windows = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs5 = __require("fs");
-    function checkPathExt(path4, options) {
+    var fs7 = __require("fs");
+    function checkPathExt(path7, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
         return true;
@@ -95,25 +110,25 @@ var require_windows = __commonJS({
       }
       for (var i = 0; i < pathext.length; i++) {
         var p = pathext[i].toLowerCase();
-        if (p && path4.substr(-p.length).toLowerCase() === p) {
+        if (p && path7.substr(-p.length).toLowerCase() === p) {
           return true;
         }
       }
       return false;
     }
-    function checkStat(stat, path4, options) {
+    function checkStat(stat, path7, options) {
       if (!stat.isSymbolicLink() && !stat.isFile()) {
         return false;
       }
-      return checkPathExt(path4, options);
+      return checkPathExt(path7, options);
     }
-    function isexe(path4, options, cb) {
-      fs5.stat(path4, function(er, stat) {
-        cb(er, er ? false : checkStat(stat, path4, options));
+    function isexe(path7, options, cb) {
+      fs7.stat(path7, function(er, stat) {
+        cb(er, er ? false : checkStat(stat, path7, options));
       });
     }
-    function sync(path4, options) {
-      return checkStat(fs5.statSync(path4), path4, options);
+    function sync(path7, options) {
+      return checkStat(fs7.statSync(path7), path7, options);
     }
   }
 });
@@ -123,14 +138,14 @@ var require_mode = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs5 = __require("fs");
-    function isexe(path4, options, cb) {
-      fs5.stat(path4, function(er, stat) {
+    var fs7 = __require("fs");
+    function isexe(path7, options, cb) {
+      fs7.stat(path7, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
-    function sync(path4, options) {
-      return checkStat(fs5.statSync(path4), options);
+    function sync(path7, options) {
+      return checkStat(fs7.statSync(path7), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -154,7 +169,7 @@ var require_mode = __commonJS({
 // node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
-    var fs5 = __require("fs");
+    var fs7 = __require("fs");
     var core;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core = require_windows();
@@ -163,7 +178,7 @@ var require_isexe = __commonJS({
     }
     module.exports = isexe;
     isexe.sync = sync;
-    function isexe(path4, options, cb) {
+    function isexe(path7, options, cb) {
       if (typeof options === "function") {
         cb = options;
         options = {};
@@ -173,7 +188,7 @@ var require_isexe = __commonJS({
           throw new TypeError("callback not provided");
         }
         return new Promise(function(resolve, reject) {
-          isexe(path4, options || {}, function(er, is) {
+          isexe(path7, options || {}, function(er, is) {
             if (er) {
               reject(er);
             } else {
@@ -182,7 +197,7 @@ var require_isexe = __commonJS({
           });
         });
       }
-      core(path4, options || {}, function(er, is) {
+      core(path7, options || {}, function(er, is) {
         if (er) {
           if (er.code === "EACCES" || options && options.ignoreErrors) {
             er = null;
@@ -192,9 +207,9 @@ var require_isexe = __commonJS({
         cb(er, is);
       });
     }
-    function sync(path4, options) {
+    function sync(path7, options) {
       try {
-        return core.sync(path4, options || {});
+        return core.sync(path7, options || {});
       } catch (er) {
         if (options && options.ignoreErrors || er.code === "EACCES") {
           return false;
@@ -210,7 +225,7 @@ var require_isexe = __commonJS({
 var require_which = __commonJS({
   "node_modules/.pnpm/which@2.0.2/node_modules/which/which.js"(exports, module) {
     var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
-    var path4 = __require("path");
+    var path7 = __require("path");
     var COLON = isWindows ? ";" : ":";
     var isexe = require_isexe();
     var getNotFoundError = (cmd) => Object.assign(new Error(`not found: ${cmd}`), { code: "ENOENT" });
@@ -248,7 +263,7 @@ var require_which = __commonJS({
           return opt.all && found.length ? resolve(found) : reject(getNotFoundError(cmd));
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path4.join(pathPart, cmd);
+        const pCmd = path7.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         resolve(subStep(p, i, 0));
       });
@@ -275,7 +290,7 @@ var require_which = __commonJS({
       for (let i = 0; i < pathEnv.length; i++) {
         const ppRaw = pathEnv[i];
         const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-        const pCmd = path4.join(pathPart, cmd);
+        const pCmd = path7.join(pathPart, cmd);
         const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
         for (let j = 0; j < pathExt.length; j++) {
           const cur = p + pathExt[j];
@@ -323,7 +338,7 @@ var require_path_key = __commonJS({
 var require_resolveCommand = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js"(exports, module) {
     "use strict";
-    var path4 = __require("path");
+    var path7 = __require("path");
     var which = require_which();
     var getPathKey = require_path_key();
     function resolveCommandAttempt(parsed, withoutPathExt) {
@@ -341,7 +356,7 @@ var require_resolveCommand = __commonJS({
       try {
         resolved = which.sync(parsed.command, {
           path: env[getPathKey({ env })],
-          pathExt: withoutPathExt ? path4.delimiter : void 0
+          pathExt: withoutPathExt ? path7.delimiter : void 0
         });
       } catch (e) {
       } finally {
@@ -350,7 +365,7 @@ var require_resolveCommand = __commonJS({
         }
       }
       if (resolved) {
-        resolved = path4.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+        resolved = path7.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
       }
       return resolved;
     }
@@ -404,8 +419,8 @@ var require_shebang_command = __commonJS({
       if (!match) {
         return null;
       }
-      const [path4, argument] = match[0].replace(/#! ?/, "").split(" ");
-      const binary = path4.split("/").pop();
+      const [path7, argument] = match[0].replace(/#! ?/, "").split(" ");
+      const binary = path7.split("/").pop();
       if (binary === "env") {
         return argument;
       }
@@ -418,16 +433,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
     "use strict";
-    var fs5 = __require("fs");
+    var fs7 = __require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs5.openSync(command, "r");
-        fs5.readSync(fd, buffer, 0, size, 0);
-        fs5.closeSync(fd);
+        fd = fs7.openSync(command, "r");
+        fs7.readSync(fd, buffer, 0, size, 0);
+        fs7.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -440,7 +455,7 @@ var require_readShebang = __commonJS({
 var require_parse = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js"(exports, module) {
     "use strict";
-    var path4 = __require("path");
+    var path7 = __require("path");
     var resolveCommand = require_resolveCommand();
     var escape = require_escape();
     var readShebang = require_readShebang();
@@ -465,7 +480,7 @@ var require_parse = __commonJS({
       const needsShell = !isExecutableRegExp.test(commandFile);
       if (parsed.options.forceShell || needsShell) {
         const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
-        parsed.command = path4.normalize(parsed.command);
+        parsed.command = path7.normalize(parsed.command);
         parsed.command = escape.command(parsed.command);
         parsed.args = parsed.args.map((arg) => escape.argument(arg, needsDoubleEscapeMetaChars));
         const shellCommand = [parsed.command].concat(parsed.args).join(" ");
@@ -575,142 +590,719 @@ var require_cross_spawn = __commonJS({
   }
 });
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime-process-utils.js
-import { execFile } from "node:child_process";
-async function closeTransportAndWait(logger, transport, options = {}) {
-  const pidBeforeClose = getTransportPid(transport);
-  const targetsBeforeClose = pidBeforeClose ? await collectProcessTreePids(pidBeforeClose) : [];
-  let closeError;
-  let closeSettled = false;
-  const closePromise = (options.close ?? (() => transport.close()))().catch((error) => {
-    closeError = error;
-    if (!options.throwOnCloseError) {
-      logger.warn(`Failed to close transport cleanly: ${error.message}`);
-    }
-  }).finally(() => {
-    closeSettled = true;
-  });
-  if (pidBeforeClose) {
-    destroyTransportStreams(transport);
-    await ensureProcessTreeTerminated(logger, pidBeforeClose, targetsBeforeClose);
-    if (!closeSettled) {
-      await Promise.race([closePromise, delay(100)]);
-    }
-  } else {
-    await closePromise;
-  }
-  if (closeError && options.throwOnCloseError) {
-    throw closeError;
-  }
-}
-function getTransportPid(transport) {
-  if ("pid" in transport) {
-    const candidate = transport.pid;
-    if (typeof candidate === "number" && candidate > 0) {
-      return candidate;
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/daemon/connection-identity.js
+import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+var BROKER_ENV = /* @__PURE__ */ new Set([
+  "MCPORTER_DAEMON_DIR",
+  "MCPORTER_DAEMON_CHILD",
+  "MCPORTER_DAEMON_SOCKET",
+  "MCPORTER_DAEMON_METADATA",
+  "MCPORTER_CONFIG",
+  "MCPORTER_DISABLE_AUTORUN",
+  "MCPORTER_DAEMON_LOG",
+  "MCPORTER_DAEMON_LOG_PATH",
+  "MCPORTER_DAEMON_LOG_SERVERS",
+  "MCPORTER_NO_FORCE_EXIT"
+]);
+async function effectiveDefinition(definition, inherited = process.env, purpose = "connection") {
+  const env = Object.fromEntries(Object.entries(resolveChromeDevtoolsRelayEnvironment(definition.env, inherited)).filter(([key, value]) => value !== void 0 && !BROKER_ENV.has(key)));
+  const configuredEnv = Object.fromEntries(Object.keys(definition.env ?? {}).filter((key) => !BROKER_ENV.has(key)).map((key) => [key, env[key] ?? ""]));
+  normalizeChromeEnvironment(definition, env);
+  const chrome = isExistingChromeDefinition(definition, env);
+  const launchCommand = definition.command.kind === "stdio" ? resolveCommandArgument(definition.command.command, env) : void 0;
+  const command = definition.command.kind === "stdio" ? {
+    ...definition.command,
+    command: chrome && purpose === "view" ? launchCommand : await resolveExecutable(launchCommand, env, definition.command.cwd),
+    args: resolveCommandArguments(definition.command.args, env),
+    cwd: await fs.realpath(definition.command.cwd)
+  } : { ...definition.command, url: new URL(definition.command.url) };
+  if (command.kind === "stdio") {
+    if (!Object.hasOwn(configuredEnv, "PWD"))
+      env.PWD = command.cwd;
+    if (!Object.hasOwn(configuredEnv, "SHLVL"))
+      delete env.SHLVL;
+  }
+  return { ...definition, command, env, configuredEnv, ...chrome ? { launchCommand } : {} };
+}
+function normalizeChromeEnvironment(definition, env) {
+  if (isExistingChromeDefinition(definition, env)) {
+    env.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY = resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, env);
+    env.MCPORTER_CHROME_DEVTOOLS_RELAY_TIMEOUT_MS = String(resolveChromeDevtoolsRelayProbeTimeoutMs(env));
+    delete env.MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY;
+    if (!env.OPENCLAW_PROFILE?.trim() || env.OPENCLAW_PROFILE.trim() === "default")
+      delete env.OPENCLAW_PROFILE;
+    if (env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL?.trim())
+      env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL = new URL(env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL.trim()).toString();
+    else
+      delete env.MCPORTER_CHROME_DEVTOOLS_RELAY_URL;
+  }
+}
+async function resolveExecutable(command, env, cwd) {
+  const roots = /[/\\]/.test(command) ? [path.resolve(cwd, command)] : (env.PATH ?? env.Path ?? "").split(path.delimiter).map((dir) => path.resolve(cwd, dir, command));
+  const extensions = process.platform === "win32" && !path.extname(command) ? ["", ...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";")] : [""];
+  const candidates = roots.flatMap((root) => extensions.map((extension) => root + extension));
+  for (const candidate of candidates) {
+    try {
+      await fs.access(candidate, fs.constants.X_OK);
+      return path.join(await fs.realpath(path.dirname(candidate)), path.basename(candidate));
+    } catch {
     }
   }
-  return null;
+  throw new Error("Unable to resolve configured executable from the effective PATH.");
+}
+function connectionIdentity(definition) {
+  const { name, description: _description, source: _source, sources: _sources, allowedTools: _allowed, blockedTools: _blocked, lifecycle: _lifecycle, configuredEnv: _configuredEnv, launchCommand: _launchCommand, logging: _logging, ...connection } = definition;
+  const credentialOwner = definition.auth || definition.command.kind === "http" ? name : void 0;
+  const env = { ...definition.env };
+  const chrome = isExistingChromeDefinition(definition);
+  if (chrome) {
+    env.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY = resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, env);
+    delete env.MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY;
+    env.MCPORTER_CHROME_DEVTOOLS_RELAY_TIMEOUT_MS = String(resolveChromeDevtoolsRelayProbeTimeoutMs(env));
+  }
+  return createHash("sha256").update(stableJsonStringify({
+    ...connection,
+    env,
+    credentialOwner,
+    idleTimeoutMs: !chrome && definition.lifecycle?.mode === "keep-alive" ? definition.lifecycle.idleTimeoutMs : void 0,
+    protocolVersion: definition.protocolVersion ?? "auto",
+    httpFetch: definition.httpFetch ?? "default",
+    chromeDevtoolsRelay: chrome ? env.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY : void 0
+  })).digest("hex");
+}
+function isExistingChromeDefinition(definition, env) {
+  if (definition.command.kind !== "stdio")
+    return false;
+  const effectiveEnv = env ?? resolveChromeDevtoolsRelayEnvironment(definition.env);
+  const command = resolveCommandArgument(definition.command.command, effectiveEnv);
+  const args = resolveCommandArguments(definition.command.args, effectiveEnv);
+  return [definition.name, command, ...args].some((value) => /chrome[-_]devtools(?:[-_]mcp)?/i.test(value)) && isExistingChromeDevtoolsCommand(command, args);
 }
-function isProcessAlive(pid) {
+
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/daemon/browser-owner.js
+import os3 from "node:os";
+import path4 from "node:path";
+
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/daemon/paths.js
+import fs3 from "node:fs/promises";
+import { constants } from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-relay-handoff.js
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import fs2 from "node:fs";
+import os from "node:os";
+import path2 from "node:path";
+import { pathToFileURL } from "node:url";
+var CHROME_RELAY_HANDOFF_ENV = "MCPORTER_CHROME_RELAY_HANDOFF_PATH";
+var HANDOFF_DIR_PREFIX = "mcporter-chrome-relay-";
+var HANDOFF_FILENAME = "headers.json";
+var PRELOAD_FILENAME = "preload.mjs";
+var WINDOWS_ACL_PATH_ENV = "MCPORTER_CHROME_RELAY_ACL_PATH";
+function createChromeDevtoolsRelayHandoff(env, clientAuthorization) {
+  let directory;
   try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
+    if (process.platform === "win32")
+      directory = createWindowsHandoffDirectory();
+    else {
+      directory = fs2.mkdtempSync(path2.join(os.tmpdir(), HANDOFF_DIR_PREFIX));
+      fs2.chmodSync(directory, 448);
+    }
+    assertSecurePath(directory, "directory");
+    const handoffPath = path2.join(directory, HANDOFF_FILENAME);
+    const preloadPath = path2.join(directory, PRELOAD_FILENAME);
+    writeExclusiveFile(preloadPath, renderChromeDevtoolsRelayPreloadSource());
+    writeExclusiveFile(handoffPath, JSON.stringify({ Authorization: clientAuthorization }));
+    const importFlag = `--import=${pathToFileURL(preloadPath).href}`;
+    const existingOptions = env.NODE_OPTIONS?.trim();
+    let closed = false;
+    return {
+      env: {
+        ...env,
+        NODE_OPTIONS: existingOptions ? `${existingOptions} ${importFlag}` : importFlag,
+        [CHROME_RELAY_HANDOFF_ENV]: handoffPath
+      },
+      handoffPath,
+      preloadPath,
+      async close() {
+        if (closed)
+          return;
+        closed = true;
+        cleanupHandoff(directory, handoffPath, preloadPath);
+      }
+    };
+  } catch (error) {
+    if (directory)
+      cleanupHandoff(directory, path2.join(directory, HANDOFF_FILENAME), path2.join(directory, PRELOAD_FILENAME));
+    const diagnostic = error instanceof Error && error.message.startsWith("Windows ACL setup failed:") ? ` ${error.message}` : "";
+    throw new Error(`Unable to install secure Chrome relay authorization handoff.${diagnostic}`, { cause: error });
   }
 }
-async function ensureProcessTreeTerminated(logger, rootPid, capturedTargets = []) {
-  let targets = uniquePids([...capturedTargets, ...await collectProcessTreePids(rootPid)]);
-  if (targets.length === 0 || await waitForTreeExit(targets, 700)) {
-    return;
-  }
-  await sendSignalToTargets(targets, "SIGTERM");
-  targets = uniquePids([...targets, ...await collectProcessTreePids(rootPid)]);
-  if (await waitForTreeExit(targets, 700)) {
-    return;
-  }
-  targets = uniquePids([...targets, ...await collectProcessTreePids(rootPid)]);
-  await sendSignalToTargets(targets, "SIGKILL");
-  if (await waitForTreeExit(targets, 500)) {
-    return;
-  }
-  logger.warn(`Process tree rooted at pid=${rootPid} did not exit after SIGKILL.`);
+function createWindowsHandoffDirectory() {
+  const directory = path2.join(os.tmpdir(), `${HANDOFF_DIR_PREFIX}${randomBytes(16).toString("hex")}`);
+  ensureWindowsPrivateDirectory(directory);
+  return directory;
 }
-function uniquePids(pids) {
-  return [...new Set(pids.filter((pid) => Number.isInteger(pid) && pid > 0))];
+function ensureWindowsPrivateDirectory(directory, allowExisting = false) {
+  const script = String.raw`
+$ErrorActionPreference = 'Stop'
+$stage = 'identity'
+try {
+$target = $env:${WINDOWS_ACL_PATH_ENV}
+${allowExisting ? "" : "if ([System.IO.Directory]::Exists($target)) { throw 'handoff path already exists' }"}
+if ([System.IO.Directory]::Exists($target) -and (([System.IO.File]::GetAttributes($target) -band [System.IO.FileAttributes]::ReparsePoint) -ne 0)) { throw 'unsafe reparse point' }
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$stage = 'descriptor'
+$security = New-Object System.Security.AccessControl.DirectorySecurity
+$sidValue = $sid.Value
+$security.SetSecurityDescriptorSddlForm("O:$($sidValue)G:$($sidValue)D:P(A;OICI;FA;;;$($sidValue))")
+$directory = New-Object System.IO.DirectoryInfo -ArgumentList @($target)
+$stage = 'create'
+$directory.Create($security)
+$stage = 'acl-read'
+$check = $directory.GetAccessControl([System.Security.AccessControl.AccessControlSections]::All)
+$rules = @($check.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+$ownerSid = $check.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
+$stage = 'acl-verify'
+if (-not $check.AreAccessRulesProtected -or $ownerSid -ne $sid.Value -or $rules.Count -ne 1) { throw 'unsafe ACL' }
+$ruleSid = $rules[0].IdentityReference.Value
+$hasFullControl = ($rules[0].FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl
+if ($ruleSid -ne $sid.Value -or $rules[0].IsInherited -or -not $hasFullControl -or $rules[0].AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { throw 'unsafe ACL' }
+} catch {
+  $type = $_.Exception.GetType().FullName
+  $hresult = ('0x{0:X8}' -f ($_.Exception.HResult -band 0xffffffffL))
+  [Console]::Error.WriteLine("stage=$stage type=$type hresult=$hresult")
+  exit 1
 }
-function destroyTransportStreams(transport) {
-  const candidate = transport;
-  for (const key of ["stdin", "stdout", "stderr"]) {
+`;
+  const result = spawnSync(resolveSystemPowerShellPath(), ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+    encoding: "utf8",
+    env: { ...process.env, [WINDOWS_ACL_PATH_ENV]: directory },
+    stdio: ["ignore", "ignore", "pipe"],
+    windowsHide: true
+  });
+  if (result.status !== 0) {
     try {
-      const stream = candidate[key];
-      stream?.destroy?.();
+      if (!allowExisting)
+        fs2.rmdirSync(directory);
     } catch {
     }
+    const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+    const safeDetail = /^[A-Za-z0-9_.:=\- ]{1,240}$/u.test(stderr) ? stderr : `stage=spawn type=${result.error?.code ?? "unknown"} hresult=unknown`;
+    throw new Error(`Windows ACL setup failed: ${safeDetail}`);
   }
 }
-async function sendSignalToTargets(pids, signal) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const pid of pids) {
-    if (seen.has(pid)) {
-      continue;
-    }
-    seen.add(pid);
-    sendSignal(pid, signal);
-  }
+function resolveSystemPowerShellPath() {
+  const systemRoot = process.env.SystemRoot?.trim() || process.env.WINDIR?.trim();
+  if (!systemRoot || !path2.win32.isAbsolute(systemRoot))
+    throw new Error("unsafe Windows system root");
+  const executable = path2.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  const stat = fs2.lstatSync(executable);
+  if (!stat.isFile() || stat.isSymbolicLink())
+    throw new Error("unsafe Windows PowerShell path");
+  return executable;
 }
-function sendSignal(pid, signal) {
+function writeExclusiveFile(filePath, contents) {
+  const descriptor = fs2.openSync(filePath, fs2.constants.O_WRONLY | fs2.constants.O_CREAT | fs2.constants.O_EXCL | (fs2.constants.O_NOFOLLOW ?? 0), 384);
   try {
-    process.kill(pid, signal);
-  } catch (error) {
-    if (typeof error === "object" && error && "code" in error && error.code === "ESRCH") {
-      return;
-    }
-    throw error;
+    if (process.platform !== "win32")
+      fs2.fchmodSync(descriptor, 384);
+    fs2.writeFileSync(descriptor, contents, "utf8");
+  } finally {
+    fs2.closeSync(descriptor);
   }
+  assertSecurePath(filePath, "file");
 }
-async function listDescendantPids(rootPid) {
-  if (!isProcessAlive(rootPid)) {
-    return [];
-  }
-  if (process.platform === "win32") {
-    return listDescendantPidsWindows(rootPid);
+function assertSecurePath(filePath, kind) {
+  const stat = fs2.lstatSync(filePath);
+  if ((kind === "directory" ? !stat.isDirectory() : !stat.isFile()) || stat.isSymbolicLink())
+    throw new Error("unsafe");
+  if (process.platform === "win32")
+    return;
+  if ((stat.mode & 63) !== 0)
+    throw new Error("unsafe");
+  if (typeof process.getuid === "function" && stat.uid !== process.getuid())
+    throw new Error("unsafe");
+}
+function cleanupHandoff(directory, handoffPath, preloadPath) {
+  for (const filePath of [handoffPath, preloadPath]) {
+    try {
+      fs2.unlinkSync(filePath);
+    } catch {
+    }
   }
   try {
-    const { stdout } = await execFileAsync("ps", ["-eo", "pid=,ppid="]);
-    const children = /* @__PURE__ */ new Map();
-    for (const line of stdout.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed) {
-        continue;
-      }
-      const [pidText, ppidText] = trimmed.split(/\s+/, 2);
-      const pid = Number.parseInt(pidText ?? "", 10);
-      const ppid = Number.parseInt(ppidText ?? "", 10);
-      if (!Number.isFinite(pid) || !Number.isFinite(ppid)) {
-        continue;
-      }
-      const bucket = children.get(ppid) ?? [];
-      bucket.push(pid);
-      children.set(ppid, bucket);
-    }
-    return collectDescendantsFromChildren(rootPid, children);
+    fs2.rmdirSync(directory);
   } catch {
-    return [];
   }
 }
-async function listDescendantPidsWindows(rootPid) {
-  try {
-    const powershellScript = "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId | ConvertTo-Json -Compress";
-    const { stdout } = await execFileAsync("powershell.exe", ["-NoProfile", "-Command", powershellScript]);
-    const trimmed = stdout.trim();
-    if (!trimmed) {
-      return [];
-    }
-    const parsed = JSON.parse(trimmed);
-    const entries = Array.isArray(parsed) ? parsed : [parsed];
-    const children = /* @__PURE__ */ new Map();
+function renderChromeDevtoolsRelayPreloadSource() {
+  return `import fs from 'node:fs';
+import path from 'node:path';
+
+const targetPath = process.argv[1]?.replaceAll('\\\\', '/').toLowerCase();
+if (targetPath?.includes('chrome-devtools-mcp')) {
+  const failureMessage = 'MCPorter Chrome relay authorization handoff unavailable.';
+  const fail = () => {
+    throw new Error(failureMessage);
+  };
+  const envName = ${JSON.stringify(CHROME_RELAY_HANDOFF_ENV)};
+  const handoffPath = process.env[envName];
+  delete process.env[envName];
+  if (!handoffPath || !path.isAbsolute(handoffPath)) fail();
+
+  const directoryStat = (() => {
+    try {
+      return fs.lstatSync(path.dirname(handoffPath));
+    } catch {
+      return fail();
+    }
+  })();
+  if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) fail();
+  if (process.platform !== 'win32') {
+    if ((directoryStat.mode & 0o077) !== 0) fail();
+    if (typeof process.getuid === 'function' && directoryStat.uid !== process.getuid()) fail();
+  }
+
+  const descriptor = (() => {
+    try {
+      return fs.openSync(handoffPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    } catch {
+      return fail();
+    }
+  })();
+
+  let raw = '';
+  let consumed = false;
+  try {
+    const stat = fs.fstatSync(descriptor);
+    if (!stat.isFile() || stat.size <= 0 || stat.size > 4_096) fail();
+    if (process.platform !== 'win32') {
+      if ((stat.mode & 0o077) !== 0) fail();
+      if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) fail();
+    }
+    raw = fs.readFileSync(descriptor, 'utf8');
+    try {
+      fs.unlinkSync(handoffPath);
+      consumed = true;
+    } catch {
+      try {
+        fs.ftruncateSync(descriptor, 0);
+        consumed = true;
+      } catch {
+        fail();
+      }
+    }
+  } finally {
+    fs.closeSync(descriptor);
+  }
+  if (!consumed) fail();
+
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    fail();
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) fail();
+  const entries = Object.entries(parsed);
+  if (entries.length !== 1 || entries[0]?.[0] !== 'Authorization') fail();
+  const authorization = entries[0]?.[1];
+  if (typeof authorization !== 'string' || !/^Bearer [A-Za-z0-9_-]{43}$/u.test(authorization)) fail();
+
+  const terminatorIndex = process.argv.indexOf('--', 2);
+  const insertionIndex = terminatorIndex >= 0 ? terminatorIndex : process.argv.length;
+  process.argv.splice(insertionIndex, 0, '--wsHeaders', JSON.stringify({ Authorization: authorization }));
+}
+`;
+}
+
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/daemon/paths.js
+import os2 from "node:os";
+import path3 from "node:path";
+function daemonBaseDir() {
+  const override = process.env.MCPORTER_DAEMON_DIR?.trim();
+  if (override)
+    return path3.resolve(override);
+  return path3.join(os2.userInfo().homedir, ".mcporter");
+}
+function daemonRunDir() {
+  return path3.join(daemonBaseDir(), "daemon");
+}
+var verifiedWindowsDirectory;
+async function secureDaemonDirectory() {
+  if (process.platform === "win32") {
+    const directory = daemonRunDir();
+    const previous = await fs3.lstat(directory).catch((error) => {
+      if (error.code !== "ENOENT")
+        throw error;
+      return void 0;
+    });
+    await verifyWindowsDaemonDirectory(directory, previous);
+    return;
+  }
+  await fs3.mkdir(daemonRunDir(), { recursive: true, mode: 448 });
+  assertPosixDaemonDirectory(await fs3.lstat(daemonRunDir()), false);
+}
+async function verifyWindowsDaemonDirectory(directory, previous) {
+  if (previous && (!previous.isDirectory() || previous.isSymbolicLink()))
+    throw new Error("Unsafe daemon directory.");
+  if (verifiedWindowsDirectory?.path !== directory || !previous || previous.dev !== verifiedWindowsDirectory.dev || previous.ino !== verifiedWindowsDirectory.ino || previous.birthtimeMs !== verifiedWindowsDirectory.birthtimeMs) {
+    ensureWindowsPrivateDirectory(directory, true);
+    const info = await fs3.lstat(directory);
+    if (!info.isDirectory() || info.isSymbolicLink())
+      throw new Error("Unsafe daemon directory.");
+    verifiedWindowsDirectory = { path: directory, dev: info.dev, ino: info.ino, birthtimeMs: info.birthtimeMs };
+  }
+}
+function assertPosixDaemonDirectory(info, allowLegacy) {
+  if (info.isDirectory() && !info.isSymbolicLink() && info.uid === process.getuid?.()) {
+    const mode = info.mode & 4095;
+    if (mode === 448 || allowLegacy && mode === 493)
+      return;
+    if (mode === 493)
+      throw new Error("Legacy daemon directory has mode 0755. Inspect with daemon migrate; after draining all old clients, run daemon migrate --stop-legacy --confirmed-drained to upgrade it to mode 0700.");
+  }
+  throw new Error("Daemon directory must be a current-user-owned directory (mode 0700), without symlinks.");
+}
+async function inspectLegacyDaemonDirectory(directory) {
+  const info = await fs3.lstat(directory).catch((error) => {
+    if (error.code !== "ENOENT")
+      throw error;
+    return void 0;
+  });
+  if (!info)
+    return false;
+  if (process.platform === "win32") {
+    await verifyWindowsDaemonDirectory(directory, info);
+  } else
+    assertPosixDaemonDirectory(info, true);
+  return true;
+}
+async function upgradeLegacyDaemonDirectory(directory) {
+  if (!await inspectLegacyDaemonDirectory(directory) || process.platform === "win32")
+    return;
+  const before = await fs3.lstat(directory);
+  assertPosixDaemonDirectory(before, true);
+  const handle = await fs3.open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+  const assertIdentity = (info) => {
+    assertPosixDaemonDirectory(info, true);
+    if (info.dev !== before.dev || info.ino !== before.ino)
+      throw new Error("Daemon directory changed during migration; inspect it before retrying.");
+  };
+  try {
+    const opened = await handle.stat();
+    assertIdentity(opened);
+    assertIdentity(await fs3.lstat(directory));
+    if ((opened.mode & 4095) === 493)
+      await handle.chmod(448);
+    assertPosixDaemonDirectory(await handle.stat(), false);
+    const after = await fs3.lstat(directory);
+    assertIdentity(after);
+    assertPosixDaemonDirectory(after, false);
+  } finally {
+    await handle.close();
+  }
+}
+function getDaemonMetadataPath(_configKey) {
+  return path3.join(daemonRunDir(), "user.json");
+}
+function getDaemonSocketPath(_configKey) {
+  if (process.platform === "win32")
+    return `\\\\.\\pipe\\mcporter-user-${createHash2("sha256").update(daemonRunDir().toLowerCase()).digest("hex").slice(0, 24)}`;
+  return path3.join(daemonRunDir(), "user.sock");
+}
+function getDaemonLogPath(_configKey) {
+  return path3.join(daemonRunDir(), "user.log");
+}
+
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/daemon/browser-owner.js
+var BrowserOwnerConflict = class extends Error {
+  code = "browser_owner_conflict";
+  constructor(reason) {
+    super(`Existing Chrome request refused: ${reason}. Use the canonical Chrome definition; if changing an existing owner, drain and stop the daemon first. This request was not retried.`);
+  }
+};
+function isCanonicalChromeNamespace() {
+  return path4.resolve(daemonBaseDir()) === path4.join(os3.userInfo().homedir, ".mcporter");
+}
+async function canonicalUserConfiguration() {
+  if (!isCanonicalChromeNamespace())
+    return { definitions: [] };
+  const home = os3.userInfo().homedir;
+  const file = mcporterConfigCandidates({ home }).find(pathExists);
+  if (!file)
+    return { definitions: [] };
+  const definitions = [];
+  const canonicalEnv = { ...process.env, HOME: home };
+  if (canonicalEnv.USERPROFILE !== void 0)
+    canonicalEnv.USERPROFILE = home;
+  for (const name of Object.keys(canonicalEnv))
+    if (name.startsWith("MCPORTER_CHROME_DEVTOOLS_RELAY_") || name === "MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY" || name.startsWith("OPENCLAW_"))
+      delete canonicalEnv[name];
+  const raw = await readConfigFile(file, true);
+  for (const [name, entry] of Object.entries(raw.mcpServers)) {
+    const launchTokens = [
+      name,
+      ...Array.isArray(entry.command) ? entry.command : [entry.command ?? ""],
+      ...entry.args ?? []
+    ];
+    if (!launchTokens.some((token) => /chrome[-_]devtools(?:[-_]mcp)?/i.test(token)))
+      continue;
+    const definition = normalizeServerEntry(name, entry, path4.dirname(file), { kind: "local", path: file }, [], {
+      env: canonicalEnv,
+      home
+    });
+    if (supportedOwner(definition))
+      definitions.push(await effectiveDefinition(definition, canonicalEnv));
+  }
+  return { definitions, idleTimeoutMs: raw.daemonIdleTimeoutMs ?? raw.daemon_idle_timeout_ms };
+}
+function supportedOwner(definition) {
+  return isExistingChromeDefinition(definition) && definition.command.kind === "stdio" && resolveChromeDevtoolsAutoConnectCommand(definition.command.command, definition.command.args).enabled;
+}
+var BrowserOwner = class {
+  identity;
+  logicalIdentity;
+  discoveryFailure;
+  get discoveryDecision() {
+    return this.discoveryFailure;
+  }
+  canonicalKeys;
+  canonical;
+  get reserved() {
+    return this.identity !== void 0;
+  }
+  constructor(canonical) {
+    this.canonical = canonical.filter(supportedOwner);
+    this.canonicalKeys = new Set(this.canonical.map(connectionIdentity));
+  }
+  reserve(definition) {
+    if (!isExistingChromeDefinition(definition))
+      return definition;
+    if (!isCanonicalChromeNamespace())
+      throw new BrowserOwnerConflict("existing local Chrome is forbidden in an isolated daemon directory");
+    if (definition.command.kind !== "stdio")
+      return definition;
+    if (!resolveChromeDevtoolsAutoConnectCommand(definition.command.command, definition.command.args).enabled)
+      throw new BrowserOwnerConflict("connection or browser-selection flags and ambiguous wrappers may reach an existing browser; only canonical auto-connect is supported");
+    const configured = this.canonical[0];
+    if (this.canonicalKeys.size !== 1 || !configured)
+      throw new BrowserOwnerConflict("canonical global Chrome definitions are missing or conflicting");
+    const overrides = definition.configuredEnv ?? definition.env;
+    if (definition.chromeDevtoolsRelay && resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, overrides ?? {}) !== resolveChromeDevtoolsRelayPolicy(configured.chromeDevtoolsRelay, configured.env))
+      throw new BrowserOwnerConflict("canonical relay policy differs");
+    const env = { ...configured.env, ...overrides };
+    normalizeChromeEnvironment(definition, env);
+    const command = configured.command.kind === "stdio" && definition.command.command === configured.launchCommand ? { ...definition.command, command: configured.command.command } : definition.command;
+    const candidate = { ...definition, command, env };
+    const identity = connectionIdentity(candidate);
+    if (!this.canonicalKeys.has(identity))
+      throw new BrowserOwnerConflict("request does not match the complete canonical global Chrome connection contract");
+    const policy = resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, env);
+    if (policy !== resolveChromeDevtoolsRelayPolicy(configured.chromeDevtoolsRelay, configured.env))
+      throw new BrowserOwnerConflict("canonical relay policy differs");
+    if (this.identity && this.identity !== identity)
+      throw new BrowserOwnerConflict("an incompatible pending or live connection already owns the browser");
+    this.identity = identity;
+    return configured;
+  }
+  async resolveIdentity(definition) {
+    const resolve = () => resolveChromeDevtoolsRelayRuntimeIdentity(chromeDevtoolsRelayEnvironmentKeys([definition], definition.env), definition.env);
+    if (!this.logicalIdentity) {
+      this.logicalIdentity = resolve().catch((error) => {
+        this.logicalIdentity = void 0;
+        throw error;
+      });
+    }
+    let retained;
+    let current;
+    try {
+      retained = await this.logicalIdentity;
+      current = await resolve();
+    } catch (error) {
+      if (error instanceof ChromeDevtoolsRelayDiscoveryError) {
+        this.discoveryFailure = error.decision;
+      }
+      throw error;
+    }
+    if (retained !== current)
+      throw new BrowserOwnerConflict("relay endpoint, credential generation or security context changed; explicit retirement is required");
+    this.discoveryFailure = void 0;
+    return retained;
+  }
+};
+
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/daemon/transport-authority.js
+var authority = /* @__PURE__ */ Symbol("broker transport authority");
+function authorizeBrokerDefinition(definition, validateRequest) {
+  Object.defineProperty(definition, authority, { value: { validateRequest }, enumerable: true });
+}
+function validateBrokerRequestAuthority(definition) {
+  return definition?.[authority]?.validateRequest?.();
+}
+function isBrokerDefinition(definition) {
+  return Boolean(definition?.[authority]);
+}
+function assertChromeBrokerAuthority(definition) {
+  if (isExistingChromeDefinition(definition) && !isBrokerDefinition(definition)) {
+    throw new BrowserOwnerConflict("programmatic or ephemeral Chrome attachment must use the daemon-backed runtime");
+  }
+}
+
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime-process-utils.js
+import { execFile } from "node:child_process";
+import { setTimeout as delay } from "node:timers/promises";
+async function captureTransportProcessTree(transport) {
+  const pid = getTransportPid(transport);
+  return { pid, targets: pid ? await collectProcessTreePids(pid) : [] };
+}
+async function closeTransportAndWait(logger, transport, options = {}) {
+  const processTree = options.processTree ?? await captureTransportProcessTree(transport);
+  const pidBeforeClose = processTree.pid;
+  const targetsBeforeClose = processTree.targets;
+  let closeError;
+  let closeSettled = false;
+  const closePromise = (options.close ?? (() => transport.close()))().catch((error) => {
+    closeError = error;
+    if (!options.throwOnCloseError) {
+      logger.warn(`Failed to close transport cleanly: ${error.message}`);
+    }
+  }).finally(() => {
+    closeSettled = true;
+  });
+  if (pidBeforeClose) {
+    destroyTransportStreams(transport);
+    await ensureProcessTreeTerminated(logger, pidBeforeClose, targetsBeforeClose, options.requireRetirement);
+    if (!closeSettled) {
+      await Promise.race([closePromise, delay(100)]);
+    }
+  } else {
+    await closePromise;
+  }
+  if (closeError && options.throwOnCloseError) {
+    if (options.requireRetirement)
+      throw Object.assign(new Error("Transport retirement failed.", { cause: closeError }), {
+        code: "transport_retirement_failed"
+      });
+    throw closeError;
+  }
+}
+function getTransportPid(transport) {
+  if ("pid" in transport) {
+    const candidate = transport.pid;
+    if (typeof candidate === "number" && candidate > 0) {
+      return candidate;
+    }
+  }
+  return null;
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function ensureProcessTreeTerminated(logger, rootPid, capturedTargets = [], requireRetirement = false) {
+  let targets = uniquePids([...capturedTargets, ...await collectProcessTreePids(rootPid)]);
+  if (targets.length === 0 || await waitForTreeExit(targets, 700)) {
+    return;
+  }
+  await sendSignalToTargets(targets, "SIGTERM");
+  targets = uniquePids([...targets, ...await collectProcessTreePids(rootPid)]);
+  if (await waitForTreeExit(targets, 700)) {
+    return;
+  }
+  targets = uniquePids([...targets, ...await collectProcessTreePids(rootPid)]);
+  await sendSignalToTargets(targets, "SIGKILL");
+  if (await waitForTreeExit(targets, 500)) {
+    return;
+  }
+  if (requireRetirement)
+    throw Object.assign(new Error("Transport process retirement could not be verified."), {
+      code: "transport_retirement_failed"
+    });
+  logger.warn(`Process tree rooted at pid=${rootPid} did not exit after SIGKILL.`);
+}
+function uniquePids(pids) {
+  return [...new Set(pids.filter((pid) => Number.isInteger(pid) && pid > 0))];
+}
+function destroyTransportStreams(transport) {
+  const candidate = transport;
+  for (const key of ["stdin", "stdout", "stderr"]) {
+    try {
+      const stream = candidate[key];
+      stream?.destroy?.();
+    } catch {
+    }
+  }
+}
+async function sendSignalToTargets(pids, signal) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const pid of pids) {
+    if (seen.has(pid)) {
+      continue;
+    }
+    seen.add(pid);
+    sendSignal(pid, signal);
+  }
+}
+function sendSignal(pid, signal) {
+  try {
+    process.kill(pid, signal);
+  } catch (error) {
+    if (typeof error === "object" && error && "code" in error && error.code === "ESRCH") {
+      return;
+    }
+    throw error;
+  }
+}
+async function listDescendantPids(rootPid) {
+  if (!isProcessAlive(rootPid)) {
+    return [];
+  }
+  if (process.platform === "win32") {
+    return listDescendantPidsWindows(rootPid);
+  }
+  try {
+    const { stdout } = await execFileAsync("ps", ["-eo", "pid=,ppid="]);
+    const children = /* @__PURE__ */ new Map();
+    for (const line of stdout.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) {
+        continue;
+      }
+      const [pidText, ppidText] = trimmed.split(/\s+/, 2);
+      const pid = Number.parseInt(pidText ?? "", 10);
+      const ppid = Number.parseInt(ppidText ?? "", 10);
+      if (!Number.isFinite(pid) || !Number.isFinite(ppid)) {
+        continue;
+      }
+      const bucket = children.get(ppid) ?? [];
+      bucket.push(pid);
+      children.set(ppid, bucket);
+    }
+    return collectDescendantsFromChildren(rootPid, children);
+  } catch {
+    return [];
+  }
+}
+async function listDescendantPidsWindows(rootPid) {
+  try {
+    const powershellScript = "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId | ConvertTo-Json -Compress";
+    const { stdout } = await execFileAsync("powershell.exe", ["-NoProfile", "-Command", powershellScript]);
+    const trimmed = stdout.trim();
+    if (!trimmed) {
+      return [];
+    }
+    const parsed = JSON.parse(trimmed);
+    const entries = Array.isArray(parsed) ? parsed : [parsed];
+    const children = /* @__PURE__ */ new Map();
     for (const entry of entries) {
       const pidCandidate = entry?.ProcessId;
       const ppidCandidate = entry?.ParentProcessId;
@@ -778,11 +1370,8 @@ async function waitForTreeExit(pids, durationMs) {
     await delay(remaining);
   }
 }
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/errors.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/errors.js
 var NON_FATAL_MCP_ERROR_CODES = /* @__PURE__ */ new Set([
   ProtocolErrorCode.InvalidRequest,
   ProtocolErrorCode.MethodNotFound,
@@ -804,8 +1393,8 @@ function protocolErrorCode(error) {
   return typeof error.code === "number" ? error.code : void 0;
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/replay-transport.js
-import fs from "node:fs";
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/replay-transport.js
+import fs4 from "node:fs";
 import { isDeepStrictEqual } from "node:util";
 var CLIENT_IDENTITY_META_KEYS = [
   "io.modelcontextprotocol/clientInfo",
@@ -860,7 +1449,7 @@ var ReplayTransport = class {
 };
 function readRecordedMessages(recordPath) {
   try {
-    const contents = fs.readFileSync(recordPath, "utf8");
+    const contents = fs4.readFileSync(recordPath, "utf8");
     return contents.split(/\r?\n/).map((line) => line.trim()).filter((line) => line.length > 0).map((line, index) => {
       try {
         return JSON.parse(line);
@@ -997,44 +1586,250 @@ function adaptInitializeResponse(method, response, requestParams) {
   if (typeof protocolVersion !== "string" || !isJsonRpcRecord(response.result)) {
     return response;
   }
-  return {
-    ...response,
-    result: { ...response.result, protocolVersion }
-  };
-}
-function isJsonRpcRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function withActiveRequestId(response, requestId) {
-  if (requestId === void 0) {
-    return response;
+  return {
+    ...response,
+    result: { ...response.result, protocolVersion }
+  };
+}
+function isJsonRpcRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function withActiveRequestId(response, requestId) {
+  if (requestId === void 0) {
+    return response;
+  }
+  return {
+    ...response,
+    id: requestId
+  };
+}
+function formatReplayMismatch(server, request, expected) {
+  const expectedText = expected ? `${expected.method} ${JSON.stringify(expected.params ?? {})}` : "no remaining recorded recv";
+  return `Replay mismatch for server '${server}': request ${request.method} ${JSON.stringify(request.params ?? {})} did not match next expected recv ${expectedText}.`;
+}
+function formatReplayRemainder(server, expectedSends) {
+  const expected = expectedSends[0];
+  const count = expectedSends.length;
+  const requestText = count === 1 ? "request" : "requests";
+  const expectedText = expected ? `${expected.method} ${JSON.stringify(expected.params ?? {})}` : "no remaining recorded recv";
+  return `Replay ended for server '${server}' with ${count} recorded ${requestText} still unused; next expected recv ${expectedText}.`;
+}
+
+// node_modules/.pnpm/@modelcontextprotocol+client@2.0.0/node_modules/@modelcontextprotocol/client/dist/stdio.mjs
+var import_cross_spawn = __toESM(require_cross_spawn(), 1);
+import process2 from "node:process";
+import { PassThrough } from "node:stream";
+var DEFAULT_INHERITED_ENV_VARS = process2.platform === "win32" ? [
+  "APPDATA",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "LOCALAPPDATA",
+  "PATH",
+  "PROCESSOR_ARCHITECTURE",
+  "SYSTEMDRIVE",
+  "SYSTEMROOT",
+  "TEMP",
+  "USERNAME",
+  "USERPROFILE",
+  "PROGRAMFILES"
+] : [
+  "HOME",
+  "LOGNAME",
+  "PATH",
+  "SHELL",
+  "TERM",
+  "USER"
+];
+function getDefaultEnvironment() {
+  const env = {};
+  for (const key of DEFAULT_INHERITED_ENV_VARS) {
+    const value = process2.env[key];
+    if (value === void 0) continue;
+    if (value.startsWith("()")) continue;
+    env[key] = value;
+  }
+  return env;
+}
+var StdioClientTransport = class {
+  _process;
+  _readBuffer;
+  _serverParams;
+  _stderrStream = null;
+  onclose;
+  onerror;
+  onmessage;
+  constructor(server) {
+    this._serverParams = server;
+    this._readBuffer = new ReadBuffer({ maxBufferSize: server.maxBufferSize });
+    if (server.stderr === "pipe" || server.stderr === "overlapped") this._stderrStream = new PassThrough();
+  }
+  /**
+  * Starts the server process and prepares to communicate with it.
+  */
+  async start() {
+    if (this._process) throw new Error("StdioClientTransport already started! If using Client class, note that connect() calls start() automatically.");
+    return new Promise((resolve, reject) => {
+      this._process = (0, import_cross_spawn.default)(this._serverParams.command, this._serverParams.args ?? [], {
+        env: {
+          ...getDefaultEnvironment(),
+          ...this._serverParams.env
+        },
+        stdio: [
+          "pipe",
+          "pipe",
+          this._serverParams.stderr ?? "inherit"
+        ],
+        shell: false,
+        windowsHide: process2.platform === "win32",
+        cwd: this._serverParams.cwd
+      });
+      this._process.on("error", (error) => {
+        reject(error);
+        this.onerror?.(error);
+      });
+      this._process.on("spawn", () => {
+        resolve();
+      });
+      this._process.on("close", (_code) => {
+        this._process = void 0;
+        this.onclose?.();
+      });
+      this._process.stdin?.on("error", (error) => {
+        this.onerror?.(error);
+      });
+      this._process.stdout?.on("data", (chunk) => {
+        try {
+          this._readBuffer.append(chunk);
+          this.processReadBuffer();
+        } catch (error) {
+          this.onerror?.(error);
+          this.close().catch(() => {
+          });
+        }
+      });
+      this._process.stdout?.on("error", (error) => {
+        this.onerror?.(error);
+      });
+      if (this._stderrStream && this._process.stderr) this._process.stderr.pipe(this._stderrStream);
+    });
+  }
+  /**
+  * The `stderr` stream of the child process, if {@linkcode StdioServerParameters.stderr} was set to `"pipe"` or `"overlapped"`.
+  *
+  * If `stderr` piping was requested, a `PassThrough` stream is returned _immediately_, allowing callers to
+  * attach listeners before the `start` method is invoked. This prevents loss of any early
+  * error output emitted by the child process.
+  */
+  get stderr() {
+    if (this._stderrStream) return this._stderrStream;
+    return this._process?.stderr ?? null;
+  }
+  /**
+  * The child process pid spawned by this transport.
+  *
+  * This is only available after the transport has been started.
+  */
+  get pid() {
+    return this._process?.pid ?? null;
+  }
+  processReadBuffer() {
+    while (true) try {
+      const message = this._readBuffer.readMessage();
+      if (message === null) break;
+      this.onmessage?.(message);
+    } catch (error) {
+      this.onerror?.(error);
+    }
+  }
+  /**
+  * Reap a disposable probe sibling (see the version-negotiation sibling
+  * flow): signal-first teardown awaiting process `exit` — never the `close`
+  * event, so a helper process holding the child's stdio pipes can never
+  * block disposal. Not part of the public transport lifecycle.
+  *
+  * @internal
+  */
+  async _dispose() {
+    const proc = this._process;
+    this._process = void 0;
+    if (proc && proc.exitCode === null && proc.signalCode === null) {
+      const exited = new Promise((resolve) => proc.once("exit", () => resolve()));
+      try {
+        proc.stdin?.end();
+      } catch {
+      }
+      try {
+        proc.kill("SIGTERM");
+      } catch {
+      }
+      await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, 1e3).unref())]);
+      if (proc.exitCode === null && proc.signalCode === null) try {
+        proc.kill("SIGKILL");
+      } catch {
+      }
+      await exited;
+    }
+    try {
+      proc?.stdout?.destroy();
+    } catch {
+    }
+    try {
+      proc?.stdin?.destroy();
+    } catch {
+    }
+    try {
+      proc?.stderr?.destroy();
+    } catch {
+    }
+    this._readBuffer.clear();
+  }
+  async close() {
+    if (this._process) {
+      const processToClose = this._process;
+      this._process = void 0;
+      const closePromise = new Promise((resolve) => {
+        processToClose.once("close", () => {
+          resolve();
+        });
+      });
+      try {
+        processToClose.stdin?.end();
+      } catch {
+      }
+      await Promise.race([closePromise, new Promise((resolve) => setTimeout(resolve, 2e3).unref())]);
+      if (processToClose.exitCode === null) {
+        try {
+          processToClose.kill("SIGTERM");
+        } catch {
+        }
+        await Promise.race([closePromise, new Promise((resolve) => setTimeout(resolve, 2e3).unref())]);
+      }
+      if (processToClose.exitCode === null) try {
+        processToClose.kill("SIGKILL");
+      } catch {
+      }
+    }
+    this._readBuffer.clear();
+  }
+  send(message) {
+    return new Promise((resolve) => {
+      if (!this._process?.stdin) throw new SdkError(SdkErrorCode.NotConnected, "Not connected");
+      const json = serializeMessage(message);
+      if (this._process.stdin.write(json)) resolve();
+      else this._process.stdin.once("drain", resolve);
+    });
   }
-  return {
-    ...response,
-    id: requestId
-  };
-}
-function formatReplayMismatch(server, request, expected) {
-  const expectedText = expected ? `${expected.method} ${JSON.stringify(expected.params ?? {})}` : "no remaining recorded recv";
-  return `Replay mismatch for server '${server}': request ${request.method} ${JSON.stringify(request.params ?? {})} did not match next expected recv ${expectedText}.`;
-}
-function formatReplayRemainder(server, expectedSends) {
-  const expected = expectedSends[0];
-  const count = expectedSends.length;
-  const requestText = count === 1 ? "request" : "requests";
-  const expectedText = expected ? `${expected.method} ${JSON.stringify(expected.params ?? {})}` : "no remaining recorded recv";
-  return `Replay ended for server '${server}' with ${count} recorded ${requestText} still unused; next expected recv ${expectedText}.`;
-}
+};
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/chrome-devtools-compat.js
-import fs3 from "node:fs";
-import os from "node:os";
-import path2 from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-compat.js
+import fs6 from "node:fs";
+import os4 from "node:os";
+import path6 from "node:path";
+import { fileURLToPath, pathToFileURL as pathToFileURL2 } from "node:url";
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/chrome-devtools-auto-connect-patch.js
-import fs2 from "node:fs";
-import path from "node:path";
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-auto-connect-patch.js
+import fs5 from "node:fs";
+import path5 from "node:path";
 var MARKER = "MCPORTER_DEVTOOLS_TIMEOUT_PATCH";
 var HELPER = `// ${MARKER}
 const MCPORTER_DEVTOOLS_DETECTION_TIMEOUT = 1_000;
@@ -1064,7 +1859,7 @@ var PATCHED_DETECTION_BLOCK = `if (await mcporterWithTimeout(page.hasDevTools(),
                 }`;
 patchChromeDevtoolsMcp();
 function patchChromeDevtoolsMcp(mainPath = process.argv[1]) {
-  patchChromeDevtoolsMcpWithDependencies(mainPath, fs2, path, MARKER, HELPER, DETECTION_BLOCK, PATCHED_DETECTION_BLOCK);
+  patchChromeDevtoolsMcpWithDependencies(mainPath, fs5, path5, MARKER, HELPER, DETECTION_BLOCK, PATCHED_DETECTION_BLOCK);
 }
 function renderChromeDevtoolsAutoConnectPatchSource() {
   return `import fs from 'node:fs';
@@ -1119,7 +1914,7 @@ ${helper}`);
   }
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/chrome-devtools-compat.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/chrome-devtools-compat.js
 var FALLBACK_PATCH_FILENAME = "mcporter-chrome-devtools-auto-connect-patch.js";
 function applyChromeDevtoolsCompat(env, command, args) {
   if (!shouldApplyChromeDevtoolsCompat(command, args, env)) {
@@ -1129,7 +1924,7 @@ function applyChromeDevtoolsCompat(env, command, args) {
   if (!patchPath) {
     return { env, applied: false };
   }
-  const importFlag = `--import=${pathToFileURL(patchPath).href}`;
+  const importFlag = `--import=${pathToFileURL2(patchPath).href}`;
   const existingOptions = env.NODE_OPTIONS?.trim();
   if (existingOptions?.includes(importFlag)) {
     return { env, applied: true, patchPath };
@@ -1149,256 +1944,31 @@ function shouldApplyChromeDevtoolsCompat(command, args, env = process.env) {
   }
   return resolveChromeDevtoolsAutoConnectCommand(command, args).enabled;
 }
-function resolveChromeDevtoolsCompatPatchPath(candidates = defaultChromeDevtoolsPatchCandidates(), fallbackDir = os.tmpdir()) {
-  const existing = candidates.find((candidate) => fs3.existsSync(candidate));
+function resolveChromeDevtoolsCompatPatchPath(candidates = defaultChromeDevtoolsPatchCandidates(), fallbackDir = os4.tmpdir()) {
+  const existing = candidates.find((candidate) => fs6.existsSync(candidate));
   if (existing) {
-    return existing;
-  }
-  return writeFallbackPatch(fallbackDir);
-}
-function defaultChromeDevtoolsPatchCandidates() {
-  const here = path2.dirname(fileURLToPath(import.meta.url));
-  return [
-    path2.join(here, "chrome-devtools-auto-connect-patch.js"),
-    path2.resolve(here, "..", "dist", "chrome-devtools-auto-connect-patch.js")
-  ];
-}
-function writeFallbackPatch(fallbackDir) {
-  const patchPath = path2.join(fallbackDir, FALLBACK_PATCH_FILENAME);
-  try {
-    fs3.writeFileSync(patchPath, renderChromeDevtoolsAutoConnectPatchSource(), { mode: 384 });
-    return patchPath;
-  } catch {
-    return void 0;
-  }
-}
-
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/chrome-devtools-relay-handoff.js
-import { spawnSync } from "node:child_process";
-import { randomBytes } from "node:crypto";
-import fs4 from "node:fs";
-import os2 from "node:os";
-import path3 from "node:path";
-import { pathToFileURL as pathToFileURL2 } from "node:url";
-var CHROME_RELAY_HANDOFF_ENV = "MCPORTER_CHROME_RELAY_HANDOFF_PATH";
-var HANDOFF_DIR_PREFIX = "mcporter-chrome-relay-";
-var HANDOFF_FILENAME = "headers.json";
-var PRELOAD_FILENAME = "preload.mjs";
-var WINDOWS_ACL_PATH_ENV = "MCPORTER_CHROME_RELAY_ACL_PATH";
-function createChromeDevtoolsRelayHandoff(env, clientAuthorization) {
-  let directory;
-  try {
-    if (process.platform === "win32")
-      directory = createWindowsHandoffDirectory();
-    else {
-      directory = fs4.mkdtempSync(path3.join(os2.tmpdir(), HANDOFF_DIR_PREFIX));
-      fs4.chmodSync(directory, 448);
-    }
-    assertSecurePath(directory, "directory");
-    const handoffPath = path3.join(directory, HANDOFF_FILENAME);
-    const preloadPath = path3.join(directory, PRELOAD_FILENAME);
-    writeExclusiveFile(preloadPath, renderChromeDevtoolsRelayPreloadSource());
-    writeExclusiveFile(handoffPath, JSON.stringify({ Authorization: clientAuthorization }));
-    const importFlag = `--import=${pathToFileURL2(preloadPath).href}`;
-    const existingOptions = env.NODE_OPTIONS?.trim();
-    let closed = false;
-    return {
-      env: {
-        ...env,
-        NODE_OPTIONS: existingOptions ? `${existingOptions} ${importFlag}` : importFlag,
-        [CHROME_RELAY_HANDOFF_ENV]: handoffPath
-      },
-      handoffPath,
-      preloadPath,
-      async close() {
-        if (closed)
-          return;
-        closed = true;
-        cleanupHandoff(directory, handoffPath, preloadPath);
-      }
-    };
-  } catch (error) {
-    if (directory)
-      cleanupHandoff(directory, path3.join(directory, HANDOFF_FILENAME), path3.join(directory, PRELOAD_FILENAME));
-    const diagnostic = error instanceof Error && error.message.startsWith("Windows ACL setup failed:") ? ` ${error.message}` : "";
-    throw new Error(`Unable to install secure Chrome relay authorization handoff.${diagnostic}`, { cause: error });
-  }
-}
-function createWindowsHandoffDirectory() {
-  const directory = path3.join(os2.tmpdir(), `${HANDOFF_DIR_PREFIX}${randomBytes(16).toString("hex")}`);
-  const script = String.raw`
-$ErrorActionPreference = 'Stop'
-$stage = 'identity'
-try {
-$target = $env:${WINDOWS_ACL_PATH_ENV}
-if ([System.IO.Directory]::Exists($target)) { throw 'handoff path already exists' }
-$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
-$stage = 'descriptor'
-$security = New-Object System.Security.AccessControl.DirectorySecurity
-$sidValue = $sid.Value
-$security.SetSecurityDescriptorSddlForm("O:$($sidValue)G:$($sidValue)D:P(A;OICI;FA;;;$($sidValue))")
-$directory = New-Object System.IO.DirectoryInfo -ArgumentList @($target)
-$stage = 'create'
-$directory.Create($security)
-$stage = 'acl-read'
-$check = $directory.GetAccessControl([System.Security.AccessControl.AccessControlSections]::All)
-$rules = @($check.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
-$ownerSid = $check.GetOwner([System.Security.Principal.SecurityIdentifier]).Value
-$stage = 'acl-verify'
-if (-not $check.AreAccessRulesProtected -or $ownerSid -ne $sid.Value -or $rules.Count -ne 1) { throw 'unsafe ACL' }
-$ruleSid = $rules[0].IdentityReference.Value
-$hasFullControl = ($rules[0].FileSystemRights -band [System.Security.AccessControl.FileSystemRights]::FullControl) -eq [System.Security.AccessControl.FileSystemRights]::FullControl
-if ($ruleSid -ne $sid.Value -or $rules[0].IsInherited -or -not $hasFullControl -or $rules[0].AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { throw 'unsafe ACL' }
-} catch {
-  $type = $_.Exception.GetType().FullName
-  $hresult = ('0x{0:X8}' -f ($_.Exception.HResult -band 0xffffffffL))
-  [Console]::Error.WriteLine("stage=$stage type=$type hresult=$hresult")
-  exit 1
-}
-`;
-  const result = spawnSync(resolveSystemPowerShellPath(), ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
-    encoding: "utf8",
-    env: { ...process.env, [WINDOWS_ACL_PATH_ENV]: directory },
-    stdio: ["ignore", "ignore", "pipe"],
-    windowsHide: true
-  });
-  if (result.status !== 0) {
-    try {
-      fs4.rmdirSync(directory);
-    } catch {
-    }
-    const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
-    const safeDetail = /^[A-Za-z0-9_.:=\- ]{1,240}$/u.test(stderr) ? stderr : `stage=spawn type=${result.error?.code ?? "unknown"} hresult=unknown`;
-    throw new Error(`Windows ACL setup failed: ${safeDetail}`);
-  }
-  return directory;
-}
-function resolveSystemPowerShellPath() {
-  const systemRoot = process.env.SystemRoot?.trim() || process.env.WINDIR?.trim();
-  if (!systemRoot || !path3.win32.isAbsolute(systemRoot))
-    throw new Error("unsafe Windows system root");
-  const executable = path3.win32.join(systemRoot, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-  const stat = fs4.lstatSync(executable);
-  if (!stat.isFile() || stat.isSymbolicLink())
-    throw new Error("unsafe Windows PowerShell path");
-  return executable;
-}
-function writeExclusiveFile(filePath, contents) {
-  const descriptor = fs4.openSync(filePath, fs4.constants.O_WRONLY | fs4.constants.O_CREAT | fs4.constants.O_EXCL | (fs4.constants.O_NOFOLLOW ?? 0), 384);
-  try {
-    if (process.platform !== "win32")
-      fs4.fchmodSync(descriptor, 384);
-    fs4.writeFileSync(descriptor, contents, "utf8");
-  } finally {
-    fs4.closeSync(descriptor);
-  }
-  assertSecurePath(filePath, "file");
-}
-function assertSecurePath(filePath, kind) {
-  const stat = fs4.lstatSync(filePath);
-  if ((kind === "directory" ? !stat.isDirectory() : !stat.isFile()) || stat.isSymbolicLink())
-    throw new Error("unsafe");
-  if (process.platform === "win32")
-    return;
-  if ((stat.mode & 63) !== 0)
-    throw new Error("unsafe");
-  if (typeof process.getuid === "function" && stat.uid !== process.getuid())
-    throw new Error("unsafe");
-}
-function cleanupHandoff(directory, handoffPath, preloadPath) {
-  for (const filePath of [handoffPath, preloadPath]) {
-    try {
-      fs4.unlinkSync(filePath);
-    } catch {
-    }
-  }
-  try {
-    fs4.rmdirSync(directory);
-  } catch {
-  }
-}
-function renderChromeDevtoolsRelayPreloadSource() {
-  return `import fs from 'node:fs';
-import path from 'node:path';
-
-const targetPath = process.argv[1]?.replaceAll('\\\\', '/').toLowerCase();
-if (targetPath?.includes('chrome-devtools-mcp')) {
-  const failureMessage = 'MCPorter Chrome relay authorization handoff unavailable.';
-  const fail = () => {
-    throw new Error(failureMessage);
-  };
-  const envName = ${JSON.stringify(CHROME_RELAY_HANDOFF_ENV)};
-  const handoffPath = process.env[envName];
-  delete process.env[envName];
-  if (!handoffPath || !path.isAbsolute(handoffPath)) fail();
-
-  const directoryStat = (() => {
-    try {
-      return fs.lstatSync(path.dirname(handoffPath));
-    } catch {
-      return fail();
-    }
-  })();
-  if (!directoryStat.isDirectory() || directoryStat.isSymbolicLink()) fail();
-  if (process.platform !== 'win32') {
-    if ((directoryStat.mode & 0o077) !== 0) fail();
-    if (typeof process.getuid === 'function' && directoryStat.uid !== process.getuid()) fail();
-  }
-
-  const descriptor = (() => {
-    try {
-      return fs.openSync(handoffPath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
-    } catch {
-      return fail();
-    }
-  })();
-
-  let raw = '';
-  let consumed = false;
-  try {
-    const stat = fs.fstatSync(descriptor);
-    if (!stat.isFile() || stat.size <= 0 || stat.size > 4_096) fail();
-    if (process.platform !== 'win32') {
-      if ((stat.mode & 0o077) !== 0) fail();
-      if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) fail();
-    }
-    raw = fs.readFileSync(descriptor, 'utf8');
-    try {
-      fs.unlinkSync(handoffPath);
-      consumed = true;
-    } catch {
-      try {
-        fs.ftruncateSync(descriptor, 0);
-        consumed = true;
-      } catch {
-        fail();
-      }
-    }
-  } finally {
-    fs.closeSync(descriptor);
+    return existing;
   }
-  if (!consumed) fail();
-
-  let parsed;
+  return writeFallbackPatch(fallbackDir);
+}
+function defaultChromeDevtoolsPatchCandidates() {
+  const here = path6.dirname(fileURLToPath(import.meta.url));
+  return [
+    path6.join(here, "chrome-devtools-auto-connect-patch.js"),
+    path6.resolve(here, "..", "dist", "chrome-devtools-auto-connect-patch.js")
+  ];
+}
+function writeFallbackPatch(fallbackDir) {
+  const patchPath = path6.join(fallbackDir, FALLBACK_PATCH_FILENAME);
   try {
-    parsed = JSON.parse(raw);
+    fs6.writeFileSync(patchPath, renderChromeDevtoolsAutoConnectPatchSource(), { mode: 384 });
+    return patchPath;
   } catch {
-    fail();
+    return void 0;
   }
-  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) fail();
-  const entries = Object.entries(parsed);
-  if (entries.length !== 1 || entries[0]?.[0] !== 'Authorization') fail();
-  const authorization = entries[0]?.[1];
-  if (typeof authorization !== 'string' || !/^Bearer [A-Za-z0-9_-]{43}$/u.test(authorization)) fail();
-
-  const terminatorIndex = process.argv.indexOf('--', 2);
-  const insertionIndex = terminatorIndex >= 0 ? terminatorIndex : process.argv.length;
-  process.argv.splice(insertionIndex, 0, '--wsHeaders', JSON.stringify({ Authorization: authorization }));
-}
-`;
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/cached-auth.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/cached-auth.js
 function hasAuthorizationHeader(headers) {
   return Boolean(headers && Object.keys(headers).some((key) => key.toLowerCase() === "authorization"));
 }
@@ -1461,15 +2031,15 @@ async function applyCachedAuthIfAvailable(definition, logger, allowCachedAuth) {
   }
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime-header-utils.js
-function materializeHeaders(headers, serverName) {
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime-header-utils.js
+function materializeHeaders(headers, serverName, env = process.env) {
   if (!headers) {
     return void 0;
   }
   const resolved = {};
   for (const [key, value] of Object.entries(headers)) {
     try {
-      resolved[key] = resolveEnvPlaceholders(value);
+      resolved[key] = resolveEnvPlaceholders(value, env);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
       throw new Error(`Failed to resolve header '${key}' for server '${serverName}': ${message}`, { cause: error });
@@ -1478,7 +2048,7 @@ function materializeHeaders(headers, serverName) {
   return resolved;
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/node-http-fetch.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/node-http-fetch.js
 import http from "node:http";
 import https from "node:https";
 import { Buffer as Buffer2 } from "node:buffer";
@@ -1637,7 +2207,7 @@ async function materializeRequestBody(body) {
   throw new TypeError("node-http1 fetch does not support streaming request bodies.");
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/http-transport.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/http-transport.js
 function extractTransportStatusCode(error) {
   if (!error || typeof error !== "object")
     return void 0;
@@ -1688,7 +2258,7 @@ function createHttpTransportOptions(definition, oauthSession, shouldEstablishOAu
   const command = definition.command;
   if (command.kind !== "http")
     throw new Error(`Server '${definition.name}' is not configured for HTTP transport.`);
-  const resolvedHeaders = materializeHeaders(command.headers, definition.name);
+  const resolvedHeaders = materializeHeaders(command.headers, definition.name, definition.env);
   const effectiveHeaders = shouldEstablishOAuth ? removeAuthorizationHeader(resolvedHeaders) : resolvedHeaders;
   const trackedFetch = trackStandaloneSseFetch(resolveHttpFetchOverride(definition));
   return {
@@ -1699,10 +2269,7 @@ function createHttpTransportOptions(definition, oauthSession, shouldEstablishOAu
   };
 }
 function trackStandaloneSseFetch(fetchOverride) {
-  let markStarted;
-  const started = new Promise((resolve) => {
-    markStarted = resolve;
-  });
+  const { promise: started, resolve: markStarted } = Promise.withResolvers();
   const baseFetch = fetchOverride ?? ((input, init) => fetch(input, init));
   return {
     started,
@@ -1763,8 +2330,7 @@ async function connectHttpTransport(client, transport, oauthSession, logger, con
     return await connectWithAuth(client, transport, oauthSession, logger, connectOptions);
   } catch (error) {
     if (!connectOptions.signal?.aborted) {
-      await closeTransportAndWait(logger, transport).catch(() => {
-      });
+      await closeTransportAndWait(logger, transport, { throwOnCloseError: true, requireRetirement: true });
     }
     throw error;
   }
@@ -1861,227 +2427,25 @@ async function connectSseFallbackTransport(client, definition, command, transpor
   }
 }
 
-// node_modules/.pnpm/@modelcontextprotocol+client@2.0.0/node_modules/@modelcontextprotocol/client/dist/stdio.mjs
-var import_cross_spawn = __toESM(require_cross_spawn(), 1);
-import process2 from "node:process";
-import { PassThrough } from "node:stream";
-var DEFAULT_INHERITED_ENV_VARS = process2.platform === "win32" ? [
-  "APPDATA",
-  "HOMEDRIVE",
-  "HOMEPATH",
-  "LOCALAPPDATA",
-  "PATH",
-  "PROCESSOR_ARCHITECTURE",
-  "SYSTEMDRIVE",
-  "SYSTEMROOT",
-  "TEMP",
-  "USERNAME",
-  "USERPROFILE",
-  "PROGRAMFILES"
-] : [
-  "HOME",
-  "LOGNAME",
-  "PATH",
-  "SHELL",
-  "TERM",
-  "USER"
-];
-function getDefaultEnvironment() {
-  const env = {};
-  for (const key of DEFAULT_INHERITED_ENV_VARS) {
-    const value = process2.env[key];
-    if (value === void 0) continue;
-    if (value.startsWith("()")) continue;
-    env[key] = value;
-  }
-  return env;
-}
-var StdioClientTransport = class {
-  _process;
-  _readBuffer;
-  _serverParams;
-  _stderrStream = null;
-  onclose;
-  onerror;
-  onmessage;
-  constructor(server) {
-    this._serverParams = server;
-    this._readBuffer = new ReadBuffer({ maxBufferSize: server.maxBufferSize });
-    if (server.stderr === "pipe" || server.stderr === "overlapped") this._stderrStream = new PassThrough();
-  }
-  /**
-  * Starts the server process and prepares to communicate with it.
-  */
-  async start() {
-    if (this._process) throw new Error("StdioClientTransport already started! If using Client class, note that connect() calls start() automatically.");
-    return new Promise((resolve, reject) => {
-      this._process = (0, import_cross_spawn.default)(this._serverParams.command, this._serverParams.args ?? [], {
-        env: {
-          ...getDefaultEnvironment(),
-          ...this._serverParams.env
-        },
-        stdio: [
-          "pipe",
-          "pipe",
-          this._serverParams.stderr ?? "inherit"
-        ],
-        shell: false,
-        windowsHide: process2.platform === "win32",
-        cwd: this._serverParams.cwd
-      });
-      this._process.on("error", (error) => {
-        reject(error);
-        this.onerror?.(error);
-      });
-      this._process.on("spawn", () => {
-        resolve();
-      });
-      this._process.on("close", (_code) => {
-        this._process = void 0;
-        this.onclose?.();
-      });
-      this._process.stdin?.on("error", (error) => {
-        this.onerror?.(error);
-      });
-      this._process.stdout?.on("data", (chunk) => {
-        try {
-          this._readBuffer.append(chunk);
-          this.processReadBuffer();
-        } catch (error) {
-          this.onerror?.(error);
-          this.close().catch(() => {
-          });
-        }
-      });
-      this._process.stdout?.on("error", (error) => {
-        this.onerror?.(error);
-      });
-      if (this._stderrStream && this._process.stderr) this._process.stderr.pipe(this._stderrStream);
-    });
-  }
-  /**
-  * The `stderr` stream of the child process, if {@linkcode StdioServerParameters.stderr} was set to `"pipe"` or `"overlapped"`.
-  *
-  * If `stderr` piping was requested, a `PassThrough` stream is returned _immediately_, allowing callers to
-  * attach listeners before the `start` method is invoked. This prevents loss of any early
-  * error output emitted by the child process.
-  */
-  get stderr() {
-    if (this._stderrStream) return this._stderrStream;
-    return this._process?.stderr ?? null;
-  }
-  /**
-  * The child process pid spawned by this transport.
-  *
-  * This is only available after the transport has been started.
-  */
-  get pid() {
-    return this._process?.pid ?? null;
-  }
-  processReadBuffer() {
-    while (true) try {
-      const message = this._readBuffer.readMessage();
-      if (message === null) break;
-      this.onmessage?.(message);
-    } catch (error) {
-      this.onerror?.(error);
-    }
-  }
-  /**
-  * Reap a disposable probe sibling (see the version-negotiation sibling
-  * flow): signal-first teardown awaiting process `exit` — never the `close`
-  * event, so a helper process holding the child's stdio pipes can never
-  * block disposal. Not part of the public transport lifecycle.
-  *
-  * @internal
-  */
-  async _dispose() {
-    const proc = this._process;
-    this._process = void 0;
-    if (proc && proc.exitCode === null && proc.signalCode === null) {
-      const exited = new Promise((resolve) => proc.once("exit", () => resolve()));
-      try {
-        proc.stdin?.end();
-      } catch {
-      }
-      try {
-        proc.kill("SIGTERM");
-      } catch {
-      }
-      await Promise.race([exited, new Promise((resolve) => setTimeout(resolve, 1e3).unref())]);
-      if (proc.exitCode === null && proc.signalCode === null) try {
-        proc.kill("SIGKILL");
-      } catch {
-      }
-      await exited;
-    }
-    try {
-      proc?.stdout?.destroy();
-    } catch {
-    }
-    try {
-      proc?.stdin?.destroy();
-    } catch {
-    }
-    try {
-      proc?.stderr?.destroy();
-    } catch {
-    }
-    this._readBuffer.clear();
-  }
-  async close() {
-    if (this._process) {
-      const processToClose = this._process;
-      this._process = void 0;
-      const closePromise = new Promise((resolve) => {
-        processToClose.once("close", () => {
-          resolve();
-        });
-      });
-      try {
-        processToClose.stdin?.end();
-      } catch {
-      }
-      await Promise.race([closePromise, new Promise((resolve) => setTimeout(resolve, 2e3).unref())]);
-      if (processToClose.exitCode === null) {
-        try {
-          processToClose.kill("SIGTERM");
-        } catch {
-        }
-        await Promise.race([closePromise, new Promise((resolve) => setTimeout(resolve, 2e3).unref())]);
-      }
-      if (processToClose.exitCode === null) try {
-        processToClose.kill("SIGKILL");
-      } catch {
-      }
-    }
-    this._readBuffer.clear();
-  }
-  send(message) {
-    return new Promise((resolve) => {
-      if (!this._process?.stdin) throw new SdkError(SdkErrorCode.NotConnected, "Not connected");
-      const json = serializeMessage(message);
-      if (this._process.stdin.write(json)) resolve();
-      else this._process.stdin.once("drain", resolve);
-    });
-  }
-};
-
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/stdio-transport.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/stdio-transport.js
 var McporterStdioTransport = class extends StdioClientTransport {
   parameters;
   meta;
   closing = false;
+  closePromise;
+  closeNotified = false;
   closeDelegate;
   messageDelegate;
   closeInterceptor = () => {
     this.meta.code = this.closing ? 0 : 1;
     flushStdioLogs(this.meta);
     void this.cleanup();
-    this.closeDelegate?.();
+    this.notifyClosed();
   };
   messageInterceptor = (message) => {
-    if (STDIO_TRACE_ENABLED)
+    if (this.parameters.lifetime?.aborted)
+      return;
+    if (STDIO_TRACE_ENABLED && !this.parameters.redactDiagnostics)
       this.meta.stdoutChunks?.push(JSON.stringify(message));
     this.messageDelegate?.(message);
   };
@@ -2101,7 +2465,8 @@ var McporterStdioTransport = class extends StdioClientTransport {
     if (stderr) {
       stderr.setEncoding?.("utf8");
       const handleChunk = (chunk) => {
-        this.meta.stderrChunks.push(Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk));
+        if (!this.parameters.redactDiagnostics)
+          this.meta.stderrChunks.push(Buffer.isBuffer(chunk) ? chunk.toString("utf8") : String(chunk));
       };
       stderr.on("data", handleChunk);
       stderr.on("error", ignoreStdioEmitterError);
@@ -2109,24 +2474,34 @@ var McporterStdioTransport = class extends StdioClientTransport {
     }
   }
   async start() {
-    if (STDIO_TRACE_ENABLED)
+    this.assertOpen();
+    if (STDIO_TRACE_ENABLED && !this.parameters.redactDiagnostics)
       console.log("[mcporter] STDIO trace: start() invoked for stdio transport.");
     this.installInterceptors();
     await super.start();
-    if (STDIO_TRACE_ENABLED) {
+    this.assertOpen();
+    if (STDIO_TRACE_ENABLED && !this.parameters.redactDiagnostics) {
       console.log(`[mcporter] STDIO trace: spawned ${this.meta.command ?? "stdio server"} (pid=${this.pid ?? "unknown"}).`);
     }
   }
   async send(message) {
+    this.assertOpen();
     this.installInterceptors();
-    if (STDIO_TRACE_ENABLED)
+    if (STDIO_TRACE_ENABLED && !this.parameters.redactDiagnostics)
       this.meta.stdinChunks?.push(JSON.stringify(message));
     await super.send(message);
   }
-  async close() {
+  close() {
+    if (this.closePromise)
+      return this.closePromise;
     this.closing = true;
     this.installInterceptors();
+    this.closePromise = this.closeOnce();
+    return this.closePromise;
+  }
+  async closeOnce() {
     try {
+      await this.parameters.prepareClose?.();
       await super.close();
     } finally {
       this.meta.code ??= 0;
@@ -2134,6 +2509,20 @@ var McporterStdioTransport = class extends StdioClientTransport {
       await this.cleanup();
     }
   }
+  assertOpen() {
+    if (this.closing || this.parameters.lifetime?.aborted)
+      throw new SdkError(SdkErrorCode.ConnectionClosed, "Transport connection closed.");
+  }
+  notifyClosed() {
+    if (this.closeNotified)
+      return;
+    this.closeNotified = true;
+    this.closeDelegate?.();
+  }
+  notifyConnectionClosed() {
+    this.installInterceptors();
+    this.notifyClosed();
+  }
   cleanup() {
     this.cleanupPromise ??= Promise.resolve(this.parameters.cleanup?.()).catch(() => {
     });
@@ -2151,7 +2540,7 @@ var McporterStdioTransport = class extends StdioClientTransport {
   }
 };
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/transport.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/transport.js
 function shouldUseModeForServer(definition, serverFilter) {
   return !serverFilter || serverFilter === definition.name;
 }
@@ -2212,9 +2601,16 @@ async function createReplayClientContext(definition, replayPath, clientInfo, opt
   return { client, transport, definition, oauthSession: void 0 };
 }
 async function createStdioClientContext(client, definition, logger, options) {
-  const mergedEnv = resolveChromeDevtoolsRelayEnvironment(definition.env);
-  const command = resolveCommandArgument(definition.command.command);
-  const resolvedArgs = resolveCommandArguments(definition.command.args);
+  const mergedEnv = {
+    ...Object.fromEntries(DEFAULT_INHERITED_ENV_VARS.map((key) => [key, void 0])),
+    ...definition.env
+  };
+  if (isBrokerDefinition(definition) && isExistingChromeDefinition(definition) && resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, definition.env) !== "off") {
+    mergedEnv.MCPORTER_CHROME_DEVTOOLS_RELAY_POLICY = "require";
+    delete mergedEnv.MCPORTER_DISABLE_CHROME_DEVTOOLS_RELAY;
+  }
+  const command = resolveCommandArgument(definition.command.command, mergedEnv);
+  const resolvedArgs = resolveCommandArguments(definition.command.args, mergedEnv);
   const publishRelayDecision = (decision) => {
     if (decision.reason === "not-eligible")
       return;
@@ -2224,7 +2620,7 @@ async function createStdioClientContext(client, definition, logger, options) {
   let relayDecision;
   let relay;
   try {
-    relay = await rewriteChromeDevtoolsArgsForRelay(command, resolvedArgs, mergedEnv, { onDecision: (decision) => relayDecision = decision }, definition.chromeDevtoolsRelay);
+    relay = await rewriteChromeDevtoolsArgsForRelay(command, resolvedArgs, mergedEnv, { onDecision: (decision) => relayDecision = decision }, isBrokerDefinition(definition) && isExistingChromeDefinition(definition) && resolveChromeDevtoolsRelayPolicy(definition.chromeDevtoolsRelay, definition.env) !== "off" ? "require" : definition.chromeDevtoolsRelay);
   } catch (error) {
     if (relayDecision)
       publishRelayDecision(relayDecision);
@@ -2234,6 +2630,9 @@ async function createStdioClientContext(client, definition, logger, options) {
   let activeProxy = relay.proxy;
   let handoff;
   let rawTransport;
+  let processTree;
+  const captureProcesses = () => processTree ??= captureTransportProcessTree(rawTransport);
+  let onProxyClosed;
   try {
     if (activeProxy) {
       try {
@@ -2266,7 +2665,12 @@ async function createStdioClientContext(client, definition, logger, options) {
       args: commandArgs,
       cwd: definition.command.cwd,
       env: compat.env,
+      redactDiagnostics: isBrokerDefinition(definition),
+      lifetime: activeProxy?.signal,
+      prepareClose: activeProxy ? async () => void await captureProcesses() : void 0,
       cleanup: activeProxy ? async () => {
+        if (onProxyClosed)
+          activeProxy?.signal.removeEventListener("abort", onProxyClosed);
         await handoff?.close();
         await activeProxy?.close();
       } : void 0
@@ -2282,15 +2686,40 @@ async function createStdioClientContext(client, definition, logger, options) {
   try {
     transport = wrapRecordTransport(rawTransport, definition, options);
   } catch (error) {
-    await closeTransportAndWait(logger, rawTransport).catch(() => {
-    });
+    await closeTransportAndWait(logger, rawTransport, { throwOnCloseError: true, requireRetirement: true });
     throw error;
   }
+  let connected = false;
+  let setupRetirement;
+  const retireSetup = () => setupRetirement ??= (async () => {
+    const captured = await captureProcesses();
+    await closeTransportAndWait(logger, transport, {
+      throwOnCloseError: true,
+      requireRetirement: true,
+      processTree: captured
+    });
+  })();
+  onProxyClosed = () => {
+    if (connected) {
+      rawTransport.notifyConnectionClosed();
+    } else {
+      void retireSetup().catch(() => {
+      });
+    }
+  };
+  activeProxy?.signal.addEventListener("abort", onProxyClosed, { once: true });
+  if (activeProxy?.signal.aborted)
+    onProxyClosed();
   try {
     await client.connect(transport, { signal: options.signal });
+    if (activeProxy?.signal.aborted)
+      throw new SdkError(SdkErrorCode.ConnectionClosed, "Chrome relay connection closed during setup.");
+    connected = true;
   } catch (error) {
-    await closeTransportAndWait(logger, transport).catch(() => {
-    });
+    const upstreamLost = activeProxy?.signal.aborted && activeProxy.signal.reason === "upstream";
+    await retireSetup();
+    if (upstreamLost)
+      throw new SdkError(SdkErrorCode.ConnectionClosed, "Chrome relay connection closed during setup.");
     throw error;
   }
   return { client, transport, definition, oauthSession: void 0 };
@@ -2299,8 +2728,10 @@ async function createClientContext(definition, logger, clientInfo, options = {})
   if (options.replayPath && shouldUseModeForServer(definition, process.env.MCPORTER_REPLAY_SERVER)) {
     return createReplayClientContext(definition, options.replayPath, clientInfo, options);
   }
-  const activeDefinition = await applyCachedAuthIfAvailable(definition, logger, options.allowCachedAuth);
-  return withEnvOverrides(activeDefinition.env, async () => {
+  assertChromeBrokerAuthority(definition);
+  const env = isBrokerDefinition(definition) ? definition.env : resolveChromeDevtoolsRelayEnvironment(definition.env);
+  return withRuntimeEnvironment(env ?? {}, async () => {
+    const activeDefinition = await applyCachedAuthIfAvailable({ ...definition, env }, logger, options.allowCachedAuth);
     if (activeDefinition.command.kind === "stdio") {
       const stdioDefinition = activeDefinition;
       try {
@@ -2327,7 +2758,7 @@ async function createClientContext(definition, logger, clientInfo, options = {})
   });
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime/connection-cache.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime/connection-cache.js
 var RuntimeConnectionCache = class {
   definitions;
   options;
@@ -2704,11 +3135,12 @@ var RuntimeConnectionCache = class {
     }
   }
   async closeContext(context) {
-    const propagateReplayCloseErrors = context.transport instanceof ReplayTransport;
+    const propagateReplayCloseErrors = context.transport instanceof ReplayTransport || isBrokerDefinition(context.definition);
     let closeError;
     try {
       await closeTransportAndWait(this.logger, context.transport, {
         throwOnCloseError: propagateReplayCloseErrors,
+        requireRetirement: isBrokerDefinition(context.definition),
         close: async () => {
           let firstError;
           const clientClose = context.client.close;
@@ -2741,7 +3173,7 @@ var RuntimeConnectionCache = class {
     }
   }
   async resetConnectionOnError(server, error, failedContext) {
-    if (!shouldResetConnection(error)) {
+    if (isBrokerDefinition(this.definitions.get(server.trim())) || !shouldResetConnection(error)) {
       return;
     }
     const normalized = server.trim();
@@ -2845,10 +3277,7 @@ var RuntimeConnectionCache = class {
   }
   async enterConnectionSetup(server) {
     const previous = this.connectionSetupTails.get(server) ?? Promise.resolve();
-    let releaseCurrent;
-    const current = new Promise((resolve) => {
-      releaseCurrent = resolve;
-    });
+    const { promise: current, resolve: releaseCurrent } = Promise.withResolvers();
     const tail = previous.catch(() => {
     }).then(() => current);
     this.connectionSetupTails.set(server, tail);
@@ -2880,7 +3309,7 @@ function connectionInfoFromClient(client) {
   };
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/tool-filters.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/tool-filters.js
 function validateToolFilters(name, filter) {
   if (filter.allowedTools !== void 0 && filter.blockedTools !== void 0) {
     throw new Error(`Server '${name}' cannot specify both allowedTools and blockedTools.`);
@@ -2902,7 +3331,7 @@ function filterTools(tools, filter) {
   return tools.filter((tool) => isToolAllowed(tool.name, filter));
 }
 
-// node_modules/.pnpm/mcporter@0.13.8/node_modules/mcporter/dist/runtime.js
+// node_modules/.pnpm/mcporter@0.13.13/node_modules/mcporter/dist/runtime.js
 var PACKAGE_NAME = "mcporter";
 var OAUTH_CODE_TIMEOUT_MS = resolveOAuthTimeoutFromEnv();
 var MAX_RESOURCE_LIST_PAGES = 100;
@@ -2929,6 +3358,7 @@ var McpRuntime = class {
   definitions;
   connectionCache;
   logger;
+  clientInfo;
   constructor(servers, options = {}) {
     for (const server of servers) {
       validateToolFilters(server.name, server);
@@ -2939,6 +3369,7 @@ var McpRuntime = class {
       name: PACKAGE_NAME,
       version: MCPORTER_VERSION
     };
+    this.clientInfo = clientInfo;
     const recordSession = process.env.MCPORTER_RECORD;
     const replaySession = process.env.MCPORTER_REPLAY;
     if (recordSession && replaySession) {
@@ -2964,6 +3395,9 @@ var McpRuntime = class {
       elicitationHandler: options.elicitationHandler ?? defaultResponder.handler
     });
   }
+  getClientInfo() {
+    return { ...this.clientInfo };
+  }
   // listServers returns configured names sorted alphabetically for stable CLI output.
   listServers() {
     return [...this.definitions.keys()].toSorted((a, b) => a.localeCompare(b));
@@ -3013,6 +3447,7 @@ var McpRuntime = class {
     let closeError;
     let tools = [];
     try {
+      await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
       const listPromise = context.client.listTools(void 0, timeoutMs ? { timeout: timeoutMs, resetTimeoutOnProgress: true, maxTotalTimeout: timeoutMs } : void 0);
       const response = timeoutMs ? await raceWithTimeout(listPromise, timeoutMs) : await listPromise;
       tools = (response.tools ?? []).map((tool) => ({
@@ -3057,6 +3492,7 @@ var McpRuntime = class {
         arguments: options.args ?? {}
       };
       const timeoutMs = normalizeTimeout(options.timeoutMs);
+      await validateBrokerRequestAuthority(definition);
       const resultPromise = client.callTool(params, {
         timeout: timeoutMs,
         // Long runs (e.g., GPT-5 Pro) emit progress/logging; allow that to refresh the timer.
@@ -3086,8 +3522,10 @@ var McpRuntime = class {
       const { client } = context;
       const requestParams = params;
       if (requestParams.cursor !== void 0) {
+        await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
         return await client.listResources(requestParams);
       }
+      await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
       let response = await client.request({ method: "resources/list", params: requestParams }, specTypeSchemas.ListResourcesResult);
       const resources = [...response.resources];
       const seenCursors = /* @__PURE__ */ new Set();
@@ -3095,6 +3533,7 @@ var McpRuntime = class {
         if (seenCursors.has(response.nextCursor))
           break;
         seenCursors.add(response.nextCursor);
+        await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
         response = await client.request({ method: "resources/list", params: { ...requestParams, cursor: response.nextCursor } }, specTypeSchemas.ListResourcesResult);
         resources.push(...response.resources);
       }
@@ -3114,6 +3553,7 @@ var McpRuntime = class {
         disableOAuth: effectiveDisableOAuth
       });
       const { client } = context;
+      await validateBrokerRequestAuthority(this.definitions.get(server.trim()));
       return await client.readResource({ uri });
     } catch (error) {
       await this.resetConnectionOnError(server, error, context);
@@ -3144,6 +3584,23 @@ function createConsoleLogger(level = resolveLogLevelFromEnv()) {
 }
 
 export {
+  effectiveDefinition,
+  connectionIdentity,
+  isExistingChromeDefinition,
+  resolveSystemPowerShellPath,
+  daemonRunDir,
+  secureDaemonDirectory,
+  inspectLegacyDaemonDirectory,
+  upgradeLegacyDaemonDirectory,
+  getDaemonMetadataPath,
+  getDaemonSocketPath,
+  getDaemonLogPath,
+  BrowserOwnerConflict,
+  canonicalUserConfiguration,
+  BrowserOwner,
+  authorizeBrokerDefinition,
+  isToolAllowed,
+  filterTools,
   createRuntime,
   callOnce
 };