@jini-ai/mcp 0.6.17 → 0.6.19

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # @jini-ai/mcp
 
+## 0.6.19
+
+- Redact config/token parsing and federation bootstrap exception diagnostics.
+- A top-level `integer` argument sent as a canonical integer string (`search_tools {max_results: "8"}`) is read as that integer instead of refused, so the agent does not lose a turn retrying.
+
 ## 0.6.17
 
 ### Patch Changes

package/dist/bin/serve.js

@@ -38,15 +38,9 @@
  */
 import { existsSync, realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { createCheckMessagesTool, messageRelayInstructions } from '../server/message-relay.js';
 import { isLoopbackHostname } from '@jini-ai/platform/net';
 import { createMcpToolServer as createMcpToolServerDefault } from '../server/tool-server.js';
-import { RUN_TOOLS } from '../server/tools/run-tools.js';
-import { describeToolTool, TOOL_CATALOG_TOOLS } from '../server/tools/tool-catalog-tools.js';
-import { COMPONENT_CATALOG_TOOLS } from '../server/tools/component-catalog-tools.js';
-import { createExecuteDelegatedToolTool, createExecuteReadonlyDelegatedToolTool } from '../server/tools/delegated-tool.js';
-import { KERNEL_RESOURCES } from '../server/resources/active-resource.js';
-import { createSiteGuideResource } from '../server/resources/site-guide-resource.js';
+import { assembleRunToolHost } from '../server/run-tool-host.js';
 /** The one run this process is scoped to for its entire lifetime. Set by the spawning daemon, never by the MCP client. */
 export const RUN_ID_ENV_VAR = 'JINI_RUN_ID';
 /** Checked (only) when resolving the daemon HTTP base URL — see `resolveDaemonUrl`'s own docs; matches the CLI entry point's identically-named constant. */
@@ -79,16 +73,6 @@ export const DELEGATED_TOOL_TIMEOUT_ENV_VAR = 'JINI_DELEGATED_TOOL_TIMEOUT_MS';
 /** JSON array of host-selected visible registry IDs; never sourced from diagnostic IDs. */
 export const STARTUP_TOOL_IDS_ENV_VAR = 'JINI_STARTUP_TOOL_IDS';
 const SERVER_NAME = 'jini-mcp';
-const SERVER_VERSION = '0.0.0';
-const INSTRUCTIONS = 'Tools proxying this host\'s Jini daemon over loopback HTTP, scoped to the run that spawned this MCP server process. ' +
-    'Use execute_delegated_tool to invoke a Jini-registered tool (never an agent-vendor-specific tool name) against that run — ' +
-    'Registered operation calls use the daemon\'s deny-by-default ToolExecutor gate; ' +
-    'MCP-local names use their existing validated handlers. ' +
-    'Concrete operation tools accept their own arguments directly. describe_tool publishes a concrete definition; ' +
-    'refresh tools/list when supported, or use the delegated gateways as the compatibility fallback. ' +
-    'When the host provides site_guide, consult jini://site-guide or call site_guide with operation overview ' +
-    'through execute_readonly_delegated_tool; follow with explain for the relevant topic ids. ' +
-    'If the host does not provide site_guide, report that availability gap.';
 // Keep the bin's environment-only assembly here; a general CLI resolver would introduce a
 // runtime dependency on another shell. No discovery/default URL is selected for a run child.
 async function resolveDaemonUrlDefault(_required, options) {
@@ -146,24 +130,20 @@ export async function serve(_requiredArgs, deps = {}) {
     };
     const delegatedGatewayOptions = buildDelegatedGatewayOptions({ env }, deps);
     const messageRelay = resolveMessageRelay({ env, runId, writeErr, exit });
-    const requiredArgs = {
-        name: SERVER_NAME,
-        version: SERVER_VERSION,
-        tools: [...buildTools({ runId, delegatedGatewayOptions }), ...(messageRelay ? [createCheckMessagesTool(messageRelay)] : [])],
-        resolveBaseUrl,
-    };
-    const serverOptions = buildServerOptions({ env, runId, delegatedGatewayOptions }, deps);
-    if (messageRelay)
-        Object.assign(serverOptions, { messageRelay, instructions: `${INSTRUCTIONS} ${messageRelayInstructions(messageRelay)}` });
     try {
         const diagnosticToolIds = parseLaunchToolIds({ env, key: 'JINI_DIAGNOSTIC_TOOL_IDS' });
-        if (diagnosticToolIds.length)
-            Object.assign(serverOptions, { diagnosticToolIds });
-        const initialTools = await resolveStartupTools({
-            toolIds: parseLaunchToolIds({ env, key: STARTUP_TOOL_IDS_ENV_VAR }), resolveBaseUrl, serverOptions,
+        // Absent credential => no `authHeaders` at all => byte-identical request headers to before this
+        // env var existed. See DAEMON_TOKEN_ENV_VAR's doc for why an unset value is not a startup failure.
+        const assembled = await assembleRunToolHost({ runId, resolveBaseUrl }, {
+            ...delegatedGatewayOptions,
+            ...definedOnly({ credential: env[DAEMON_TOKEN_ENV_VAR], fetchImpl: deps.fetchImpl,
+                messageRelayNonce: messageRelay?.nonce }),
+            startupToolIds: parseLaunchToolIds({ env, key: STARTUP_TOOL_IDS_ENV_VAR }),
+            ...(diagnosticToolIds.length ? { diagnosticToolIds } : {}),
         });
-        Object.assign(serverOptions, { delegatedTools: { runId, ...delegatedGatewayOptions, initialTools } });
-        await createMcpToolServerFn(requiredArgs, serverOptions).run({});
+        await createMcpToolServerFn(assembled.required, { ...assembled.options,
+            ...definedOnly({ stdin: deps.stdin, stdout: deps.stdout }),
+        }).run({});
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -211,33 +191,6 @@ function buildDelegatedGatewayOptions({ env }, deps) {
         delegatedToolTimeoutMs: rawTimeout === undefined ? undefined : Number(rawTimeout),
     });
 }
-function buildTools({ runId, delegatedGatewayOptions }) {
-    return [
-        ...RUN_TOOLS,
-        ...TOOL_CATALOG_TOOLS,
-        ...COMPONENT_CATALOG_TOOLS,
-        createExecuteDelegatedToolTool({ runId }, delegatedGatewayOptions),
-        // Hosted ALONGSIDE the unconstrained gateway, never instead of it. A client that gates on
-        // `readOnlyHint: true` can now reach the read half of the catalog at all; every other client
-        // sees both and picks by what its call actually does.
-        createExecuteReadonlyDelegatedToolTool({ runId }, delegatedGatewayOptions),
-    ];
-}
-function buildServerOptions({ env, runId, delegatedGatewayOptions }, deps) {
-    // Absent credential => no `authHeaders` at all => byte-identical request headers to before this
-    // env var existed. See DAEMON_TOKEN_ENV_VAR's doc for why an unset value is not a startup failure.
-    const credential = env[DAEMON_TOKEN_ENV_VAR];
-    return {
-        resources: [...KERNEL_RESOURCES, createSiteGuideResource({ runId }, delegatedGatewayOptions)],
-        instructions: INSTRUCTIONS,
-        ...definedOnly({
-            authHeaders: credential ? { Authorization: `Bearer ${credential}` } : undefined,
-            fetchImpl: deps.fetchImpl,
-            stdin: deps.stdin,
-            stdout: deps.stdout,
-        }),
-    };
-}
 // Only the spawning host supplies registration metadata. Never learn exceptions from an
 // error body or model arguments: either would turn a secret into its own redaction exemption.
 function parseLaunchToolIds({ env, key }) {
@@ -247,28 +200,6 @@ function parseLaunchToolIds({ env, key }) {
     }
     return toolIds;
 }
-/**
- * Resolve each unique startup ID through the existing authenticated describe/publication owner.
- * The temporary descriptor list seeds M1's bounded exposure; it is not an execution catalog.
- * Failure aborts startup before any partially resolved list can reach the client.
- * @returns Authoritative descriptors; no daemon I/O when startup IDs are absent.
- * @throws The existing descriptor/daemon errors, reported by serve's stderr/exit boundary.
- * @complexity O(n + s) space/time plus n sequential bounded GETs for n unique IDs and s schema bytes.
- */
-async function resolveStartupTools({ toolIds, resolveBaseUrl, serverOptions }) {
-    if (toolIds.length === 0)
-        return [];
-    const descriptors = [];
-    const ctx = {
-        baseUrl: await resolveBaseUrl(),
-        fetchImpl: serverOptions.fetchImpl ?? fetch,
-        ...definedOnly({ authHeaders: serverOptions.authHeaders, diagnosticToolIds: serverOptions.diagnosticToolIds }),
-        publishTool: async ({ descriptor }) => { descriptors.push(descriptor); },
-    };
-    for (const id of new Set(toolIds))
-        await describeToolTool.handler({ args: { id }, ctx });
-    return descriptors;
-}
 // Only run for real when this module is the actual process entrypoint (`node dist/bin/serve.js`,
 // or the `jini-mcp` bin shim pnpm/npm links to it) — not merely imported, e.g. by this file's own
 // tests importing the named `serve` export above. Mirrors the CLI entry point's identical guard.

package/dist/core/config.js

@@ -1,3 +1,5 @@
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { isLoopbackHostname } from '@jini-ai/platform/net';
 /**
  * @module @jini-ai/mcp/core/config
@@ -232,7 +234,7 @@ export async function readMcpConfig({ dataDir }, { filesystem = defaultFilesyste
         if (e.code === 'ENOENT')
             return { servers: [] };
         if (e.name === 'SyntaxError') {
-            console.error('[mcp-config] Corrupted JSON, returning empty:', e.message);
+            console.error('[mcp-config] Corrupted JSON, returning empty:', redactSecrets({ input: inspect(e) }, { redactPii: false }));
             return { servers: [] };
         }
         throw err;

package/dist/core/tokens.js

@@ -1,3 +1,5 @@
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { createSystemClock } from "@jini-ai/core/primitives";
 /**
  * @module @jini-ai/mcp/core/tokens
@@ -145,7 +147,7 @@ export async function readTokensFile({ dataDir }, options = {}) {
                 filePath: `${tokensFile(dataDir)}.corrupt-${digest}`,
                 contents: raw,
             });
-            console.error('[mcp-tokens] Corrupted JSON, returning empty:', e.message);
+            console.error('[mcp-tokens] Corrupted JSON, returning empty:', redactSecrets({ input: inspect(e) }, { redactPii: false }));
             return { ...EMPTY, servers: { ...EMPTY.servers } };
         }
         throw err;

package/dist/federation/bootstrap.d.ts

@@ -46,10 +46,9 @@ export interface AttachFederatedToolsResult {
      * connection was simply invisible everywhere an operator could look — `GET
      * /api/federation/admissions` showed no row for it and `configFailures` (a SEPARATE, boot-time
      * config-resolution channel — see `external-mcp-connection-source.ts`) has no way to know about a
-     * failure that happens deeper, inside `connect()` itself. `reason` is `messageOf(error)` — the
-     * same text `logger.warn` already prints for this exact failure, so this field discloses nothing
-     * that was not already reaching this process's own stderr; it is never a raw env value or secret,
-     * since nothing in this file's `connect`/`spawn` error paths ever formats one into a message.
+     * failure that happens deeper, inside `connect()` itself. The message is redacted before it
+     * reaches this caller-visible field: remote failures can echo tokens and credentialed URLs,
+     * and the log's separate redaction does not protect the returned value.
      */
     readonly connectFailures: readonly {
         readonly connectionId: string;

package/dist/federation/bootstrap.js

@@ -1,3 +1,5 @@
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { createConsoleLogger } from "@jini-ai/core/primitives";
 import { defaultFederatedMcpPresetRegistry } from "./presets.js";
 import { federateSession } from "./registrations.js";
@@ -142,13 +144,19 @@ async function attachOneFederatedConnection(params) {
         const registeredToolIds = registerFederatedTools(registry, registrations);
         logger.info({ message: `mcp-federation: '${connectionId}' registered ${registrations.length} federated tool(s): ${registrations.map((r) => r.descriptor.id).join(", ") || "(none)"}` });
         logFederatedAdmissionReport(connectionId, report, logger);
+        // An empty grant has no callable handler retaining this session. Release its child/socket
+        // before a later operator grant re-admits the row with a new session.
+        if (connection.config.allowedToolNames.length === 0) {
+            await session.close({});
+            return { registeredToolIds, session: null, report };
+        }
         return { registeredToolIds, session, report };
     }
     catch (error) {
-        logger.warn({ message: `mcp-federation: '${connectionId}' failed, continuing without its tools — ${messageOf(error)}` });
+        logger.warn({ message: `mcp-federation: '${connectionId}' failed, continuing without its tools — ${redactSecrets({ input: inspect(error) }, { redactPii: false })}` });
         // A session that connected but failed during listing/admission still owns a child process.
         await session?.close({}).catch(() => undefined);
-        return { registeredToolIds: [], session: null, report: null, connectFailureReason: messageOf(error) };
+        return { registeredToolIds: [], session: null, report: null, connectFailureReason: redactSecrets({ input: messageOf(error) }, { redactPii: false }) };
     }
 }
 /**
@@ -171,7 +179,7 @@ export function resolveFederatedMcpPresets({ env, logger, registry }, _optional
                 connections.push(connection);
         }
         catch (error) {
-            logger.warn({ message: `mcp-federation: preset '${preset.presetId}' configuration is invalid, continuing without federated tools — ${messageOf(error)}` });
+            logger.warn({ message: `mcp-federation: preset '${preset.presetId}' configuration is invalid, continuing without federated tools — ${redactSecrets({ input: inspect(error) }, { redactPii: false })}` });
         }
     }
     return connections;

package/dist/federation/reload.d.ts

@@ -14,7 +14,7 @@ import type { FederationDeps } from "./registrations.js";
  *
  * `trust.ts` R5 freezes an ALREADY-ADMITTED connection's tool set at connect, forever, for this
  * process's lifetime — the rug-pull protection that file's own header explains. This module never
- * re-lists, re-classifies, or re-admits a connectionId that has already gone through
+ * re-lists, re-classifies, or re-admits a connectionId with admitted tools that has gone through
  * {@link attachFederatedMcpTools} once, whether that pass ran at boot or at an earlier reload
  * ({@link selectUnadmittedConnections} is the whole enforcement mechanism: a connectionId already in
  * `admittedConnectionIds` is filtered out before `attach` is ever called on it again). It only ever
@@ -22,6 +22,9 @@ import type { FederationDeps } from "./registrations.js";
  * is the same guarantee a fresh boot already gives, just applied to a connection that did not exist
  * yet when this process started. `ToolRegistry` (`@jini-ai/core`) is deliberately append-only with no
  * unregister, so this module still has no way to revise or drop an admitted tool even if it wanted to.
+ * A roster row admitted with an empty allowlist and no tools can wait for its first operator grant.
+ * Retrying that row replaces no tool or classification; after its first nonempty admission it freezes
+ * just like every other connection. An unchanged empty grant never triggers another handshake.
  *
  * That admission freeze no longer means an operator's edit is inert until restart, though —
  * `external-mcp-revocation.ts`'s per-call gate (`mcp-federation/registrations.ts`'s
@@ -108,5 +111,7 @@ export interface FederationReloadCoordinator {
 export declare function createFederationReloadCoordinator({ coordDeps, initiallyAdmitted }: {
     coordDeps: FederationReloadCoordinatorDeps;
     initiallyAdmitted: Iterable<string>;
+}, { initiallyAwaitingGrants }?: {
+    initiallyAwaitingGrants?: Iterable<string>;
 }): FederationReloadCoordinator;
 //# sourceMappingURL=reload.d.ts.map

package/dist/federation/reload.js

@@ -11,7 +11,7 @@ import { attachFederatedMcpTools } from "./bootstrap.js";
  *
  * `trust.ts` R5 freezes an ALREADY-ADMITTED connection's tool set at connect, forever, for this
  * process's lifetime — the rug-pull protection that file's own header explains. This module never
- * re-lists, re-classifies, or re-admits a connectionId that has already gone through
+ * re-lists, re-classifies, or re-admits a connectionId with admitted tools that has gone through
  * {@link attachFederatedMcpTools} once, whether that pass ran at boot or at an earlier reload
  * ({@link selectUnadmittedConnections} is the whole enforcement mechanism: a connectionId already in
  * `admittedConnectionIds` is filtered out before `attach` is ever called on it again). It only ever
@@ -19,6 +19,9 @@ import { attachFederatedMcpTools } from "./bootstrap.js";
  * is the same guarantee a fresh boot already gives, just applied to a connection that did not exist
  * yet when this process started. `ToolRegistry` (`@jini-ai/core`) is deliberately append-only with no
  * unregister, so this module still has no way to revise or drop an admitted tool even if it wanted to.
+ * A roster row admitted with an empty allowlist and no tools can wait for its first operator grant.
+ * Retrying that row replaces no tool or classification; after its first nonempty admission it freezes
+ * just like every other connection. An unchanged empty grant never triggers another handshake.
  *
  * That admission freeze no longer means an operator's edit is inert until restart, though —
  * `external-mcp-revocation.ts`'s per-call gate (`mcp-federation/registrations.ts`'s
@@ -57,28 +60,44 @@ export function selectUnadmittedConnections({ allConnections, admittedConnection
  * @complexity `reload()` is O(c · t) in the unadmitted connection count and their advertised tools
  * (the underlying `attachFederatedMcpTools` cost); `admittedConnectionIds()` is O(1).
  */
-export function createFederationReloadCoordinator({ coordDeps, initiallyAdmitted }) {
+export function createFederationReloadCoordinator({ coordDeps, initiallyAdmitted }, { initiallyAwaitingGrants = [] } = {}) {
     const admitted = new Set(initiallyAdmitted);
+    const awaitingGrants = new Set(initiallyAwaitingGrants);
     const attach = coordDeps.attach ?? attachFederatedMcpTools;
     let inFlight = null;
     let queuedNext = null;
     async function runOnePass() {
         const allConnections = await coordDeps.resolveConnections();
-        const unadmitted = selectUnadmittedConnections({ allConnections: allConnections, admittedConnectionIds: admitted });
+        const eligibleIds = new Set(admitted);
+        for (const connection of allConnections) {
+            if (awaitingGrants.has(connection.config.connectionId) && connection.config.allowedToolNames.length > 0)
+                eligibleIds.delete(connection.config.connectionId);
+        }
+        const unadmitted = selectUnadmittedConnections({ allConnections, admittedConnectionIds: eligibleIds });
         if (unadmitted.length === 0)
             return { newlyAdmittedConnectionIds: [], reports: [], connectFailures: [] };
         // Empty, not omitted: omission resolves presets from the environment again, even though the
         // boot pass already admitted them. Reload concerns only the operator-editable roster;
         // environment presets cannot change without a real restart.
         const attached = await attach({ registry: coordDeps.registry, deps: coordDeps.deps, connect: coordDeps.connect }, { connections: [], extraConnections: unadmitted, ...(coordDeps.logger ? { logger: coordDeps.logger } : {}) });
-        for (const entry of attached.reports)
-            admitted.add(entry.connectionId);
+        const attemptedConnections = new Map(unadmitted.map(connection => [connection.config.connectionId, connection]));
+        for (const entry of attached.reports) {
+            rememberAdmission({ entry, connection: attemptedConnections.get(entry.connectionId) });
+        }
         return {
             newlyAdmittedConnectionIds: attached.reports.map((entry) => entry.connectionId),
             reports: attached.reports,
             connectFailures: attached.connectFailures,
         };
     }
+    /** Only a successful empty-grant admission remains eligible for its first operator grant. O(1). */
+    function rememberAdmission({ entry, connection }, _options = {}) {
+        admitted.add(entry.connectionId);
+        if (connection?.config.allowedToolNames.length === 0 && entry.report.admitted.length === 0)
+            awaitingGrants.add(entry.connectionId);
+        else
+            awaitingGrants.delete(entry.connectionId);
+    }
     function reload(_required) {
         if (!inFlight) {
             inFlight = runOnePass().finally(() => {

package/dist/index.d.ts

@@ -12,8 +12,8 @@ export type { StoredMcpToken, McpTokensFile } from './core/index.js';
 export { buildMcpInstallPayload } from './core/index.js';
 export type { BuildMcpInstallPayloadInputs, McpInstallPayload } from './core/index.js';
 export { createMcpIdleExitController, extractRelativeRefs, isTextualMime, } from './client/index.js';
-export { cancelRunTool, createMcpToolServer, daemonCallOptions, errorResult, getActiveContextTool, getDaemonJson, getRunTool, listAgentsTool, okResult, postDaemonJson, requireString, RUN_TOOLS, startRunTool, toolsToList, buildToolIndex, handleToolCall, DaemonResponseTooLargeError, } from './server/index.js';
-export type { DaemonRequestOptions, McpServerLike, McpToolContext, McpToolDef, McpToolServerHandle, McpToolServerOptions, McpTransportLike, } from './server/index.js';
+export { cancelRunTool, createMcpToolServer, startMcpHttpToolServer, createMcpHttpToolServerRuntime, daemonCallOptions, errorResult, getActiveContextTool, getDaemonJson, getRunTool, listAgentsTool, okResult, postDaemonJson, requireString, RUN_TOOLS, startRunTool, toolsToList, buildToolIndex, handleToolCall, DaemonResponseTooLargeError, } from './server/index.js';
+export type { DaemonRequestOptions, McpServerLike, McpToolContext, McpToolDef, McpToolServerHandle, McpHttpToolServerHandle, McpHttpToolServerRuntime, McpHttpToolServerOptions, McpToolServerOptions, McpTransportLike, } from './server/index.js';
 export { activeContextResource, createSiteGuideResource, buildResourceIndex, handleResourceRead, KERNEL_RESOURCES, resourcesToList, } from './server/index.js';
 export type { McpResourceDef, McpResourceReadResult } from './server/index.js';
 export { searchToolsTool, describeToolTool, TOOL_CATALOG_TOOLS } from './server/index.js';
@@ -29,4 +29,7 @@ export type { McpIdleTimerPort } from './client/client.js';
 export type { McpToolServerRequiredArgs } from './server/tool-server.js';
 export type { CreateExecuteDelegatedToolToolRequiredArgs } from './server/tools/delegated-tool.js';
 export { DaemonHttpError } from './server/daemon-client.js';
+export { assembleRunToolHost } from './server/run-tool-host.js';
+export type { RunToolHostInput, RunToolHostOptions, RunToolHost } from './server/run-tool-host.js';
+export { MCP_HTTP_SESSION_MODE_SUPPORTED } from './server/http-tool-server.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -14,7 +14,7 @@ export { buildMcpInstallPayload } from './core/index.js';
 // ── client: product-neutral stdio-server runtime primitives ─────────────────
 export { createMcpIdleExitController, extractRelativeRefs, isTextualMime, } from './client/index.js';
 // ── server: the generic MCP tool-hosting mechanism + kernel-run tool defs ───
-export { cancelRunTool, createMcpToolServer, daemonCallOptions, errorResult, getActiveContextTool, getDaemonJson, getRunTool, listAgentsTool, okResult, postDaemonJson, requireString, RUN_TOOLS, startRunTool, toolsToList, buildToolIndex, handleToolCall, DaemonResponseTooLargeError, } from './server/index.js';
+export { cancelRunTool, createMcpToolServer, startMcpHttpToolServer, createMcpHttpToolServerRuntime, daemonCallOptions, errorResult, getActiveContextTool, getDaemonJson, getRunTool, listAgentsTool, okResult, postDaemonJson, requireString, RUN_TOOLS, startRunTool, toolsToList, buildToolIndex, handleToolCall, DaemonResponseTooLargeError, } from './server/index.js';
 // ── server: the generic MCP resource surface + kernel resource defs ────────
 export { activeContextResource, createSiteGuideResource, buildResourceIndex, handleResourceRead, KERNEL_RESOURCES, resourcesToList, } from './server/index.js';
 // ── server: the tool-catalog discovery defs (search_tools / describe_tool) ──
@@ -26,4 +26,6 @@ export { createExecuteDelegatedToolTool, createExecuteReadonlyDelegatedToolTool,
 // ── agent-install: register an MCP server into external agents ──────────────
 export { CHROME_DEVTOOLS_MCP_PRESET, AGENT_SLUGS, isAgentSlug, planAgentInstall, verifyJsonAgentInstall, applyJsonInstall, removeJsonInstall, } from './agent-install/index.js';
 export { DaemonHttpError } from './server/daemon-client.js';
+export { assembleRunToolHost } from './server/run-tool-host.js';
+export { MCP_HTTP_SESSION_MODE_SUPPORTED } from './server/http-tool-server.js';
 //# sourceMappingURL=index.js.map

package/dist/server/daemon-client.d.ts

@@ -22,8 +22,8 @@ export interface DaemonRequestOptions {
     /** Defaults to the global `fetch`; inject for tests. */
     fetchImpl?: typeof fetch;
     headers?: Record<string, string>;
-    /** Request deadline in ms. Defaults to {@link DEFAULT_TIMEOUT_MS}. */
-    timeoutMs?: number;
+    /** Request deadline in ms. Null delegates lifetime to caller/run cancellation; omission uses DEFAULT_TIMEOUT_MS. */
+    timeoutMs?: number | null;
     /** Maximum daemon response size in bytes before the read is aborted. Defaults to {@link DEFAULT_MAX_RESPONSE_BYTES}. */
     maxResponseBytes?: number;
     /** Caller-supplied cancellation signal; combined with the internal timeout signal, so either one aborts the request. */

package/dist/server/daemon-client.js

@@ -155,6 +155,9 @@ function formatDaemonHttpError({ status, data }, options) {
  */
 function startDeadline({ route, timeoutMs }, { signal }) {
     const timeoutController = new AbortController();
+    // An interactive delegated call is bounded by its run/caller cancellation, not human reading time.
+    if (timeoutMs === null)
+        return { signal: signal ?? timeoutController.signal, clear: () => { } };
     const timeoutHandle = setTimeout(() => {
         timeoutController.abort(new Error(`request to ${route} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
@@ -192,7 +195,7 @@ async function readBodyOrExplain({ resp, url, maxResponseBytes }, options) {
 async function requestDaemonJson(baseUrl, route, init, options = {}) {
     const fetchImpl = options.fetchImpl ?? fetch;
     const url = `${baseUrl}${route}`;
-    const deadline = startDeadline({ route, timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS }, { signal: options.signal });
+    const deadline = startDeadline({ route, timeoutMs: options.timeoutMs === undefined ? DEFAULT_TIMEOUT_MS : options.timeoutMs }, { signal: options.signal });
     try {
         let resp;
         try {

package/dist/server/http-tool-server.d.ts

@@ -0,0 +1,44 @@
+import { type IncomingMessage, type ServerResponse, type Server as HttpServer } from 'node:http';
+import { type McpToolServerRequiredArgs, type McpToolServerOptions } from './tool-server.js';
+export interface McpHttpToolServerOptions extends Pick<McpToolServerOptions, 'resources' | 'instructions' | 'fetchImpl' | 'authHeaders' | 'delegatedTools' | 'resultPaging' | 'diagnosticToolIds' | 'messageRelay'> {
+    /** One SDK session per run listener; desktop remains stateless by default. */
+    readonly sessionMode?: boolean;
+    /** Value-free diagnostics. Never receives headers, bodies, tool arguments or credentials. */
+    readonly warn?: (message: string) => void;
+    /** Native listener seam for embeddings and wire-level lifecycle tests. */
+    readonly createHttpServer?: (listener: (request: IncomingMessage, response: ServerResponse) => void) => HttpServer;
+}
+export interface McpHttpToolServerHandle {
+    readonly url: string;
+    readonly token: string;
+    /** Stop admission and drain accepted work; no idle timer interrupts handlers. */
+    close(required: Record<string, never>, optional?: Record<string, never>): Promise<void>;
+}
+/** Embeddings must gate CLI HTTP on retained-session support rather than a protocol probe. */
+export declare const MCP_HTTP_SESSION_MODE_SUPPORTED = true;
+/** Bind a private loopback listener. Desktop requests use fresh stateless SDK transports;
+ * run listeners opt into one retained SDK session and the same host-owned dispatch contract. Auth precedes body parsing; browsers are always refused.
+ * @example const host = await startMcpHttpToolServer({ name, version, tools, resolveBaseUrl });
+ * @throws Listen/configuration errors; the embedding owns degraded startup and retries.
+ * @complexity O(body bytes + dispatched handler), with 16 requests and 1 MB per body maximum.
+ */
+export declare function startMcpHttpToolServer(required: McpToolServerRequiredArgs, options?: McpHttpToolServerOptions): Promise<McpHttpToolServerHandle>;
+export interface McpHttpToolServerRuntime {
+    /** Best-effort startup: absent until a listener binds; failures repair in the background. */
+    capability(required: Record<string, never>, optional?: Record<string, never>): Promise<Pick<McpHttpToolServerHandle, 'url' | 'token'> | undefined>;
+    /** Deliver a capability after binding, including initial recovery. Failed handoffs retry;
+     * unsubscribe cancels pending deliveries. This must never be used to replay tool calls. */
+    subscribe(required: {
+        listener: (capability: Pick<McpHttpToolServerHandle, 'url' | 'token'>) => void | Promise<void>;
+    }, optional?: Record<string, never>): () => void;
+    close(required: Record<string, never>, optional?: Record<string, never>): Promise<void>;
+}
+/** Own one shared HTTP listener independently of site/window lifecycles. No I/O until capability()
+ * is called. Concurrent callers share a start; shutdown cancels retries and drains a pending bind.
+ * @example const runtime = createMcpHttpToolServerRuntime({ name, version, tools, resolveBaseUrl });
+ * @complexity O(1) state beyond the bounded HTTP listener and caller-supplied tool table.
+ */
+export declare function createMcpHttpToolServerRuntime(required: McpToolServerRequiredArgs, { start, ...options }?: McpHttpToolServerOptions & {
+    start?: typeof startMcpHttpToolServer;
+}): McpHttpToolServerRuntime;
+//# sourceMappingURL=http-tool-server.d.ts.map