@kwonye/mcpx 0.1.104 → 0.1.106

package/dist/core/plugin-projections.d.ts

@@ -6,4 +6,5 @@ export declare function pruneAllPluginProjections(targetDir: string): void;
  */
 export declare function pruneUnlistedPlugins(targetDir: string, keepPluginIds: string[]): void;
 export declare function syncPluginsToClient(clientId: string, plugins: PluginSyncInput[]): PluginSyncResult;
+export declare function syncProjectPluginSkills(clientId: string, skillsBase: string, plugins: PluginSyncInput[]): PluginSyncResult;
 //# sourceMappingURL=plugin-projections.d.ts.map

package/dist/core/runtime-entry.d.ts

@@ -0,0 +1,6 @@
+export declare function localCliCommand(args: string[]): {
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+};
+//# sourceMappingURL=runtime-entry.d.ts.map

package/dist/core/runtime-snapshot.d.ts

@@ -0,0 +1,6 @@
+import type { McpxConfig } from "../types.js";
+/** A gateway request sees one committed configuration revision throughout its work. */
+export declare function compileRuntimeSnapshot(): void;
+export declare function clearRuntimeSnapshot(): void;
+export declare function runtimeConfig(): McpxConfig;
+//# sourceMappingURL=runtime-snapshot.d.ts.map

package/dist/core/secret-keychain.d.ts

@@ -0,0 +1,31 @@
+/** Login-keychain item that holds the whole mcpx secret map for this user. */
+export declare const KEYCHAIN_SERVICE = "com.kwonye.mcpx";
+export declare const KEYCHAIN_ACCOUNT = "secrets";
+export declare const KEYCHAIN_LABEL = "mcpx secrets";
+/**
+ * `security -i` reads each command with readline() into a 4096-byte buffer
+ * (SecurityTool `MAX_LINE_LEN`) and keeps at most 4095 bytes. A line of exactly
+ * 4095 bytes leaves the trailing newline unread; the following empty command
+ * succeeds and becomes the process exit status. 4094 leaves room for that newline.
+ */
+export declare const SECURITY_INTERACTIVE_MAX_LINE = 4094;
+export interface SecretCommandRequest {
+    command: string;
+    args: string[];
+    input?: string;
+}
+export interface SecretCommandResult {
+    status: number;
+    stdout: string;
+    stderr: string;
+}
+export type SecretCommandRunner = (request: SecretCommandRequest) => SecretCommandResult;
+/** Test hook. Production code leaves the real `security` / `secret-tool` runner in place. */
+export declare function setSecretCommandRunnerForTests(runner: SecretCommandRunner | null): void;
+/** Test hook. `null` uses `process.platform`. */
+export declare function setSecretKeychainPlatformForTests(platform: NodeJS.Platform | null): void;
+export declare function keychainUnsupportedReason(platform?: NodeJS.Platform): string | null;
+export declare function readKeychainSecrets(): Record<string, string>;
+export declare function writeKeychainSecrets(secrets: Record<string, string>): void;
+export declare function clearKeychainSecrets(): void;
+//# sourceMappingURL=secret-keychain.d.ts.map

package/dist/core/secrets.d.ts

@@ -1,9 +1,19 @@
+import type { SecretBackendKind } from "../types.js";
+export interface SecretBackendSwitchResult {
+    backend: SecretBackendKind;
+    changed: boolean;
+    migrated: string[];
+    preserved: string[];
+    removedFrom: SecretBackendKind | null;
+}
+export declare function describeSecretBackend(backend: SecretBackendKind): string;
+export declare function getSecretBackend(configPath?: string): SecretBackendKind;
+export declare function switchSecretBackend(target: SecretBackendKind, configPath?: string): SecretBackendSwitchResult;
 export declare class SecretsManager {
     private readonly storePath;
     private readonly keyPath;
     constructor(storePath?: string, keyPath?: string);
-    private readStore;
-    private recoverCorruptStore;
+    get backend(): SecretBackendKind;
     listSecretNames(): string[];
     setSecret(name: string, value: string): void;
     removeSecret(name: string): void;

package/dist/core/served-skills.d.ts

@@ -0,0 +1,62 @@
+import { z } from "zod";
+import type { McpxConfig } from "../types.js";
+export declare function skillVisible(config: McpxConfig, id: string, projectPath?: string): boolean;
+declare const frontmatterSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+}, z.core.$loose>;
+interface ServedSkill {
+    uri: string;
+    frontmatter: z.infer<typeof frontmatterSchema>;
+    resources: Array<{
+        uri: string;
+        digest: string;
+        size: number;
+    }>;
+    files: Map<string, Buffer>;
+}
+export declare function servedSkills(config: McpxConfig, projectPath?: string): ServedSkill[];
+export declare function listServedSkills(config: McpxConfig, projectPath?: string, cursor?: string): {
+    ttlMs: number;
+    cacheScope: string;
+    nextCursor?: string | undefined;
+    resultType: string;
+    skills: {
+        uri: string;
+        frontmatter: z.infer<typeof frontmatterSchema>;
+        resources: Array<{
+            uri: string;
+            digest: string;
+            size: number;
+        }>;
+    }[];
+};
+export declare function getServedSkill(config: McpxConfig, uri: string, projectPath?: string): {
+    resultType: string;
+    skill: {
+        uri: string;
+        frontmatter: z.infer<typeof frontmatterSchema>;
+        resources: Array<{
+            uri: string;
+            digest: string;
+            size: number;
+        }>;
+    };
+    ttlMs: number;
+    cacheScope: string;
+};
+export declare function readServedSkill(config: McpxConfig, uri: string, projectPath?: string): {
+    contents: ({
+        text: string;
+        uri: string;
+        mimeType: string;
+    } | {
+        blob: string;
+        uri: string;
+        mimeType: string;
+    })[];
+    ttlMs: number;
+    cacheScope: string;
+};
+export {};
+//# sourceMappingURL=served-skills.d.ts.map

package/dist/core/share.d.ts

@@ -0,0 +1,71 @@
+import { z } from "zod";
+declare const environmentSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    generatedBy: z.ZodString;
+    servers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+        transport: z.ZodLiteral<"http">;
+        url: z.ZodURL;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>, z.ZodObject<{
+        transport: z.ZodLiteral<"stdio">;
+        command: z.ZodString;
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        cwd: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>], "transport">>>;
+    skills: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodEnum<{
+            skill: "skill";
+            plugin: "plugin";
+        }>;
+        path: z.ZodString;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    plugins: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodEnum<{
+            skill: "skill";
+            plugin: "plugin";
+        }>;
+        path: z.ZodString;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    clients: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    inputs: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+declare const lockSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    mcpxCompatibility: z.ZodString;
+    manifestSha256: z.ZodString;
+    packages: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        sha256: z.ZodString;
+        revision: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ShareEnvironment = z.infer<typeof environmentSchema>;
+export type ShareLock = z.infer<typeof lockSchema>;
+export declare function exportEnvironment(destination: string, options?: {
+    skills?: string[];
+    plugins?: string[];
+}): {
+    environment: ShareEnvironment;
+    lock: ShareLock;
+};
+export declare function importEnvironment(sourceDirectory: string, options?: {
+    locked?: boolean;
+    dryRun?: boolean;
+    inputs?: Record<string, string>;
+}): Promise<{
+    importedSkills: string[];
+    importedPlugins: string[];
+    importedServers: string[];
+    missingInputs: string[];
+}>;
+export {};
+//# sourceMappingURL=share.d.ts.map

package/dist/core/skills.d.ts

@@ -1,6 +1,13 @@
 import type { Skill } from "../types.js";
+export declare function validateSkillPackage(root: string): void;
 export declare function listSkills(): Skill[];
 export declare function getSkill(id: string): Skill | null;
 export declare function saveSkill(id: string, content: string): void;
 export declare function deleteSkill(id: string): void;
+export declare function customizeSkill(id: string, targetId?: string): Skill;
+export declare function installSkillFromSource(source: string, skillName?: string): Promise<Skill>;
+export declare function pinSkill(id: string): void;
+export declare function unpinSkill(id: string): void;
+export declare function updateSkill(id: string): Promise<Skill>;
+export declare function rollbackSkill(id: string): Skill;
 //# sourceMappingURL=skills.d.ts.map

package/dist/core/status.d.ts

@@ -32,6 +32,7 @@ export interface StatusReport {
     servers: StatusServerEntry[];
     clients: McpxConfig["clients"];
     projects?: McpxConfig["projects"];
+    fetchError?: string;
     totalGlobalTokens?: number;
     totalProjectTokens?: Record<string, number>;
 }

package/dist/core/sync-plan.d.ts

@@ -0,0 +1,14 @@
+/** Read-only synchronization preview; credentials and raw configurations stay local. */
+export declare function planSynchronization(targets?: string[]): {
+    revision: number;
+    harnesses: {
+        id: string;
+        configPath: string | null;
+        changes: {
+            name: string;
+            action: string;
+        }[];
+        message: string;
+    }[];
+};
+//# sourceMappingURL=sync-plan.d.ts.map

package/dist/core/sync.d.ts

@@ -3,7 +3,10 @@ import { SecretsManager } from "./secrets.js";
 export interface SyncOptions {
     targetClients?: ClientId[];
     importScan?: boolean;
+    configPath?: string;
 }
+/** Canonical sync transaction shared by the CLI, desktop service and plugins. */
+export declare function synchronizeClients(options?: SyncOptions, secrets?: SecretsManager): Promise<SyncSummary>;
 export interface SyncSummary {
     gatewayUrl: string;
     imports: SyncImportReport;

package/dist/core/telemetry.d.ts

@@ -19,6 +19,8 @@ declare const launchModeSchema: z.ZodEnum<{
     project: "project";
     proxy: "proxy";
     auth: "auth";
+    skill: "skill";
+    list: "list";
     plugin: "plugin";
     desktop: "desktop";
     daemon: "daemon";
@@ -26,11 +28,9 @@ declare const launchModeSchema: z.ZodEnum<{
     remove: "remove";
     enable: "enable";
     disable: "disable";
-    list: "list";
     sync: "sync";
     doctor: "doctor";
     secret: "secret";
-    skill: "skill";
     "plugin-host": "plugin-host";
     update: "update";
     telemetry: "telemetry";

package/dist/core/tui.d.ts

@@ -0,0 +1,20 @@
+type TuiRow = {
+    title: string;
+    state: string;
+    detail: string;
+};
+interface TuiFrameOptions {
+    width: number;
+    height: number;
+    revision: number;
+    view: number;
+    summary: string;
+    rows: TuiRow[];
+    selection: number;
+    details: string[];
+    status: string;
+}
+export declare function renderManagementTuiFrame(frame: TuiFrameOptions): string;
+export declare function runManagementTui(cliPath: string): Promise<void>;
+export {};
+//# sourceMappingURL=tui.d.ts.map

package/dist/core/verify-upstreams.d.ts

@@ -0,0 +1,4 @@
+import type { McpxConfig } from "../types.js";
+/** Only discovery/list operations are used before retiring native registrations. */
+export declare function verifyUpstreams(config: McpxConfig, names: string[]): Promise<void>;
+//# sourceMappingURL=verify-upstreams.d.ts.map

package/dist/core/work-limiter.d.ts

@@ -0,0 +1,10 @@
+/** Bounds work per upstream instance, including queued requests. */
+export declare class WorkLimiter {
+    private readonly concurrency;
+    private readonly queueLimit;
+    private active;
+    private waiting;
+    constructor(concurrency?: number, queueLimit?: number);
+    run<T>(signal: AbortSignal, work: () => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=work-limiter.d.ts.map

package/dist/gateway/server.d.ts

@@ -1,4 +1,5 @@
 import http from "node:http";
+import { WorkLimiter } from "../core/work-limiter.js";
 import { Client } from "@modelcontextprotocol/client";
 import { StdioClientTransport } from "@modelcontextprotocol/client/stdio";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
@@ -10,6 +11,7 @@ interface GatewayServerOptions {
     secrets: SecretsManager;
 }
 interface UpstreamConnection {
+    limiter: WorkLimiter;
     fingerprint: string;
     client: Client;
     transport: StdioClientTransport | StreamableHTTPClientTransport;

package/dist/types.d.ts

@@ -1,12 +1,15 @@
-export type ClientId = "claude" | "claude-desktop" | "codex" | "cursor" | "cline" | "opencode" | "kiro" | "vscode" | "qwen" | "openclaw" | "hermes";
+/** Harness IDs come from the adapter registry, including project installations. */
+export type ClientId = string;
 export type PluginComponent = "mcpServers" | "skills" | "hooks" | "agents" | "commands";
 export interface HttpServerSpec {
+    scope?: string;
     transport: "http";
     url: string;
     headers?: Record<string, string>;
     enabled?: boolean;
 }
 export interface StdioServerSpec {
+    scope?: string;
     transport: "stdio";
     command: string;
     args?: string[];
@@ -20,6 +23,8 @@ export interface GatewayConfig {
     tokenRef: string;
     autoStart: boolean;
 }
+/** Where stored secrets live. `file` is the default encrypted file; `keychain` is opt-in. */
+export type SecretBackendKind = "file" | "keychain";
 export type ClientStatus = "SYNCED" | "UNSUPPORTED_HTTP" | "ERROR" | "SKIPPED";
 export interface ClientSyncState {
     status: ClientStatus;
@@ -38,6 +43,44 @@ export interface ProjectScope {
 }
 export interface McpxConfig {
     schemaVersion: 1;
+    consumers?: Record<string, {
+        tokenRef: string;
+        projectPath?: string;
+    }>;
+    packages?: Record<string, {
+        id: string;
+        root: string;
+        source: string;
+        harness: string;
+        fingerprint: string;
+        pinned: boolean;
+        name?: string;
+        identity?: string;
+        servers?: string[];
+        skills?: Array<{
+            id: string;
+            path: string;
+            projectionPath: string;
+        }>;
+        scope?: string;
+        previous?: {
+            root: string;
+            fingerprint: string;
+        };
+    }>;
+    revision?: number;
+    harnesses?: Record<string, {
+        mode: "observe" | "selected" | "automatic";
+    }>;
+    origins?: Record<string, {
+        id: string;
+        kind: string;
+        harness: string;
+        source: string;
+        nativeKey: string;
+        fingerprint: string;
+        operationId: string;
+    }>;
     name?: string;
     gateway: GatewayConfig;
     servers: Record<string, UpstreamServerSpec>;
@@ -45,6 +88,9 @@ export interface McpxConfig {
     projects?: Record<string, ProjectConfig>;
     plugins?: Record<string, ManagedPlugin>;
     marketplaces?: Record<string, ManagedMarketplace>;
+    secrets?: {
+        backend: SecretBackendKind;
+    };
 }
 export interface ManagedEntry {
     fingerprint: string;
@@ -117,8 +163,15 @@ export interface SyncResult {
     driftedEntries?: string[];
 }
 export interface Skill {
+    projectionPath?: string;
+    scope?: string;
+    ownerHarness?: string;
     id: string;
     content: string;
+    /** Canonical directory containing SKILL.md and optional resources. */
+    root?: string;
+    source?: "authored" | "installed";
+    readOnly?: boolean;
 }
 export interface PluginSyncInput {
     pluginId: string;
@@ -140,12 +193,24 @@ export interface PluginSyncResult {
     unsupported: PluginComponent[];
     error?: string;
 }
+export interface HarnessDescriptor {
+    label?: string;
+    projectConfig?: string;
+    skillPath?: string;
+    projectSkills?: string;
+    skillLayout?: "dir" | "flat";
+    pluginComponents?: PluginComponent[];
+}
 export interface ClientAdapter {
+    descriptor?: HarnessDescriptor;
+    managedName?(serverName: string): string;
     id: ClientId;
     detectConfigPath(): string | null;
     supportsHttp(): boolean;
     scanForImports(config: McpxConfig, managedIndex: ManagedIndex): ClientImportScanResult;
     syncGateway(config: McpxConfig, options: SyncClientOptions): SyncResult;
+    skillDirectory?(): string;
+    additionalSkillDirectories?(): string[];
     syncSkills?(skills: Skill[]): void;
     syncPlugins?(plugins: PluginSyncInput[]): PluginSyncResult;
 }
@@ -319,6 +384,12 @@ export interface ManagedPlugin {
         sourceFingerprint: string;
     };
     updateError?: string;
+    pinned?: boolean;
+    previous?: {
+        version: string;
+        resolvedSha: string;
+        root: string;
+    };
     projectOverrides?: Record<string, {
         enabled?: boolean;
         components?: Partial<Record<PluginComponent, boolean>>;

package/dist/util/fs.d.ts

@@ -2,4 +2,6 @@ export declare function readJsonFile<T>(filePath: string, fallback: T): T;
 export declare function writeJsonAtomic(filePath: string, data: unknown): void;
 export declare function sha256(value: string): string;
 export declare function safeReadFile(filePath: string): string | null;
+/** Native configuration must fail closed; malformed files are never reset. */
+export declare function readJsonStrict<T>(filePath: string, fallback: T): T;
 //# sourceMappingURL=fs.d.ts.map

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const APP_VERSION = "0.1.3";
+export declare const APP_VERSION = "0.1.106";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kwonye/mcpx",
-  "version": "0.1.104",
+  "version": "0.1.106",
   "description": "HTTP-first MCP gateway and cross-client installer",
   "keywords": [
     "mcp",

package/dist/adapters/opencode.d.ts

@@ -1,11 +0,0 @@
-import type { ClientAdapter, ManagedIndex, McpxConfig, Skill, SyncClientOptions, SyncResult, PluginSyncInput, PluginSyncResult } from "../types.js";
-export declare class OpenCodeAdapter implements ClientAdapter {
-    readonly id: "opencode";
-    detectConfigPath(): string | null;
-    supportsHttp(): boolean;
-    syncPlugins(plugins: PluginSyncInput[]): PluginSyncResult;
-    syncSkills(skills: Skill[]): void;
-    scanForImports(_config: McpxConfig, managedIndex: ManagedIndex): import("../types.js").ClientImportScanResult;
-    syncGateway(_config: McpxConfig, options: SyncClientOptions): SyncResult;
-}
-//# sourceMappingURL=opencode.d.ts.map