@loompad/cli 0.1.0 → 1.1.1

package/dist/core/hosted.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The hosted Loom Team Hub (Supabase) that ships in the build.
+ *
+ * The publishable key is public by design: it only identifies the project.
+ * Every read is row-level-security checked against the signed-in user's JWT,
+ * and every write goes through a rule function (supabase/migrations).
+ * LOOM_SUPABASE_URL / LOOM_SUPABASE_PUBLISHABLE_KEY point a build elsewhere.
+ */
+export declare const HOSTED_SUPABASE_URL = "https://ufpkfpzspfzzxabklyec.supabase.co";
+export declare const HOSTED_SUPABASE_PUBLISHABLE_KEY = "sb_publishable_DBiS9r-XDdqlgjt_bdpC2w_JdXqEvb1";
+/** How a hosted hub is written in team.json and invite links: `supabase:<project url>`. */
+export declare const HOSTED_HUB_PREFIX = "supabase:";
+export interface HostedTarget {
+    supabaseUrl: string;
+    publishableKey: string;
+}
+/** The hosted project in effect: env overrides first, then the built-in one. */
+export declare function hostedTarget(env?: NodeJS.ProcessEnv): HostedTarget;
+/**
+ * The Supabase project URL a hub string names, or null when it's a self-hosted
+ * `loom hub`. Empty / "hosted" mean the hosted project in effect; so does its
+ * bare URL; `supabase:<url>` names one explicitly.
+ */
+export declare function hostedSupabaseUrl(hub: string | undefined | null, env?: NodeJS.ProcessEnv): string | null;
+export declare function hostedHubUrl(supabaseUrl: string): string;
+/** The publishable key for a Supabase project URL: the env/built-in one (a key is per project). */
+export declare function publishableKeyFor(supabaseUrl: string, env?: NodeJS.ProcessEnv): string;

package/dist/core/hosted.js

@@ -0,0 +1,50 @@
+/**
+ * The hosted Loom Team Hub (Supabase) that ships in the build.
+ *
+ * The publishable key is public by design: it only identifies the project.
+ * Every read is row-level-security checked against the signed-in user's JWT,
+ * and every write goes through a rule function (supabase/migrations).
+ * LOOM_SUPABASE_URL / LOOM_SUPABASE_PUBLISHABLE_KEY point a build elsewhere.
+ */
+export const HOSTED_SUPABASE_URL = "https://ufpkfpzspfzzxabklyec.supabase.co";
+export const HOSTED_SUPABASE_PUBLISHABLE_KEY = "sb_publishable_DBiS9r-XDdqlgjt_bdpC2w_JdXqEvb1";
+/** How a hosted hub is written in team.json and invite links: `supabase:<project url>`. */
+export const HOSTED_HUB_PREFIX = "supabase:";
+/** The hosted project in effect: env overrides first, then the built-in one. */
+export function hostedTarget(env = process.env) {
+    return {
+        supabaseUrl: (env.LOOM_SUPABASE_URL || HOSTED_SUPABASE_URL).replace(/\/$/, ""),
+        publishableKey: env.LOOM_SUPABASE_PUBLISHABLE_KEY || HOSTED_SUPABASE_PUBLISHABLE_KEY,
+    };
+}
+/**
+ * The Supabase project URL a hub string names, or null when it's a self-hosted
+ * `loom hub`. Empty / "hosted" mean the hosted project in effect; so does its
+ * bare URL; `supabase:<url>` names one explicitly.
+ */
+export function hostedSupabaseUrl(hub, env = process.env) {
+    const h = (hub ?? "").trim().replace(/\/$/, "");
+    const target = hostedTarget(env).supabaseUrl;
+    if (!h || h.toLowerCase() === "hosted")
+        return target;
+    if (h.startsWith(HOSTED_HUB_PREFIX))
+        return h.slice(HOSTED_HUB_PREFIX.length).replace(/\/$/, "") || target;
+    if (h.startsWith(target))
+        return target;
+    if (h.startsWith(HOSTED_SUPABASE_URL))
+        return HOSTED_SUPABASE_URL;
+    return null;
+}
+export function hostedHubUrl(supabaseUrl) {
+    return HOSTED_HUB_PREFIX + supabaseUrl.replace(/\/$/, "");
+}
+/** The publishable key for a Supabase project URL: the env/built-in one (a key is per project). */
+export function publishableKeyFor(supabaseUrl, env = process.env) {
+    const t = hostedTarget(env);
+    if (supabaseUrl.replace(/\/$/, "") === t.supabaseUrl)
+        return t.publishableKey;
+    if (supabaseUrl.replace(/\/$/, "") === HOSTED_SUPABASE_URL)
+        return HOSTED_SUPABASE_PUBLISHABLE_KEY;
+    return t.publishableKey;
+}
+//# sourceMappingURL=hosted.js.map

package/dist/core/hosted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted.js","sourceRoot":"","sources":["../../src/core/hosted.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AAC9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,gDAAgD,CAAC;AAEhG,2FAA2F;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAO7C,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,OAAO;QACL,WAAW,EAAE,CAAC,GAAG,CAAC,iBAAiB,IAAI,mBAAmB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC9E,cAAc,EAAE,GAAG,CAAC,6BAA6B,IAAI,+BAA+B;KACrF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAA8B,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;IAC7C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;IAC3G,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,WAAmB;IAC9C,OAAO,iBAAiB,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACzF,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,WAAW;QAAE,OAAO,CAAC,CAAC,cAAc,CAAC;IAC9E,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,mBAAmB;QAAE,OAAO,+BAA+B,CAAC;IACnG,OAAO,CAAC,CAAC,cAAc,CAAC;AAC1B,CAAC"}

package/dist/core/http-server.d.ts

@@ -0,0 +1,5 @@
+import type { Server } from "node:http";
+/** A client can be blocked in synchronous Git/CLI work longer than Node's
+ * five-second idle default. Keep its pooled socket alive through that work
+ * so the next request cannot race a delayed close notification on Windows. */
+export declare function configureHttpServer(server: Server): void;

package/dist/core/http-server.js

@@ -0,0 +1,8 @@
+/** A client can be blocked in synchronous Git/CLI work longer than Node's
+ * five-second idle default. Keep its pooled socket alive through that work
+ * so the next request cannot race a delayed close notification on Windows. */
+export function configureHttpServer(server) {
+    server.keepAliveTimeout = 65_000;
+    server.headersTimeout = 70_000;
+}
+//# sourceMappingURL=http-server.js.map

package/dist/core/http-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-server.js","sourceRoot":"","sources":["../../src/core/http-server.ts"],"names":[],"mappings":"AAEA;;8EAE8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC;IACjC,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;AACjC,CAAC"}

package/dist/core/invite-link.d.ts

@@ -0,0 +1,31 @@
+/**
+ * One link to join a team (daemon/onboard.ts).
+ *
+ * An invite is an https URL, so it opens from WhatsApp, Slack or email like
+ * any link. The page it opens (site/join/) is static: it reads the #fragment
+ * in the browser and hands it to the Loom on that machine, or shows the one
+ * command that installs Loom and joins. The fragment never reaches a server —
+ * browsers don't send it — and it is the whole invite: team key, hub, repo.
+ *
+ * Every older or local form still works anywhere a link is accepted:
+ * `loom://team/join#…`, `http://localhost:7420/app#join=…`, or the bare
+ * fragment.
+ */
+/** Where invite links point. LOOM_JOIN_URL moves it (a fork, a self-hosted page). */
+export declare const DEFAULT_JOIN_URL = "https://nickthelegend.github.io/loom/join/";
+export declare function joinBase(env?: NodeJS.ProcessEnv): string;
+export declare function inviteLink(fragment: string, env?: NodeJS.ProcessEnv): string;
+/** The invite fragment out of any form of the link. */
+export declare function inviteFragment(link: string): string;
+/** What a link would set up, without redeeming anything — for "Join Acme?". */
+export declare function previewInvite(link: string): {
+    team: string | null;
+    teamId: string | null;
+    repo: string | null;
+    from: string | null;
+    project: string | null;
+    hub: string;
+    crews: string[];
+    /** Carries its inviter's device signature (checked after joining). */
+    signed: boolean;
+} | null;

package/dist/core/invite-link.js

@@ -0,0 +1,45 @@
+/**
+ * One link to join a team (daemon/onboard.ts).
+ *
+ * An invite is an https URL, so it opens from WhatsApp, Slack or email like
+ * any link. The page it opens (site/join/) is static: it reads the #fragment
+ * in the browser and hands it to the Loom on that machine, or shows the one
+ * command that installs Loom and joins. The fragment never reaches a server —
+ * browsers don't send it — and it is the whole invite: team key, hub, repo.
+ *
+ * Every older or local form still works anywhere a link is accepted:
+ * `loom://team/join#…`, `http://localhost:7420/app#join=…`, or the bare
+ * fragment.
+ */
+import { unpackInvite } from "./team-crypto.js";
+/** Where invite links point. LOOM_JOIN_URL moves it (a fork, a self-hosted page). */
+export const DEFAULT_JOIN_URL = "https://nickthelegend.github.io/loom/join/";
+export function joinBase(env = process.env) {
+    return (env.LOOM_JOIN_URL || DEFAULT_JOIN_URL).replace(/#.*$/, "");
+}
+export function inviteLink(fragment, env = process.env) {
+    return `${joinBase(env)}#${fragment}`;
+}
+/** The invite fragment out of any form of the link. */
+export function inviteFragment(link) {
+    const s = link.trim().replace(/^['"<]+|['">]+$/g, "");
+    const hash = s.includes("#") ? s.slice(s.indexOf("#") + 1) : s;
+    return hash.replace(/^join=/, "").replace(/^\/?/, "");
+}
+/** What a link would set up, without redeeming anything — for "Join Acme?". */
+export function previewInvite(link) {
+    const inv = unpackInvite(inviteFragment(link));
+    if (!inv)
+        return null;
+    return {
+        team: inv.team ?? null,
+        teamId: inv.teamId ?? null,
+        repo: inv.repo ?? null,
+        from: inv.from ?? null,
+        signed: Boolean(inv.sig && inv.dev),
+        project: inv.project ?? null,
+        hub: inv.hub,
+        crews: (inv.crews ?? []).map((c) => c.name),
+    };
+}
+//# sourceMappingURL=invite-link.js.map

package/dist/core/invite-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite-link.js","sourceRoot":"","sources":["../../src/core/invite-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAuB,MAAM,kBAAkB,CAAC;AAErE,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,4CAA4C,CAAC;AAE7E,MAAM,UAAU,QAAQ,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC3D,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC/E,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,IAAY;IAWxC,MAAM,GAAG,GAA0B,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;QAC1B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI;QACtB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;QACnC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/core/loops.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Loop watch: an agent stuck re-running the same thing.
+ *
+ * The expensive failure isn't the error — it's the agent that hits the same
+ * failing test eight times, or runs the same command in a circle, burning
+ * tokens while you're away. Within one turn this counts each command (or tool
+ * call) by what it is, and says so once when:
+ *
+ *   failing    the same command has failed 3 times
+ *   repeating  the exact same call has been made 5 times
+ *
+ * Pure: the runtime feeds it events and decides what to do (watchdog config).
+ */
+import type { LoomEvent } from "../types.js";
+export interface Loop {
+    agentId: string;
+    chat: string;
+    kind: "failing" | "repeating";
+    /** The command or call, as the thread shows it. */
+    call: string;
+    count: number;
+    /** The last failure's output, when there was one. */
+    output?: string;
+}
+export declare const FAILING_AT = 3;
+export declare const REPEATING_AT = 5;
+/** "npm  test  -- --run" and "npm test -- --run" are the same call; so are two reads of one file. */
+export declare function signature(p: Record<string, unknown>): string | null;
+export declare class LoopWatch {
+    private turns;
+    /** One event; returns a loop the first time this turn crosses a line, else null. */
+    observe(e: LoomEvent): Loop | null;
+    /** A person spoke in the chat: every agent's count there starts over. */
+    reset(chat: string): void;
+}
+/** What Loom tells a stuck agent when it nudges it. */
+export declare function nudgeText(loop: Loop): string;

package/dist/core/loops.js

@@ -0,0 +1,81 @@
+/**
+ * Loop watch: an agent stuck re-running the same thing.
+ *
+ * The expensive failure isn't the error — it's the agent that hits the same
+ * failing test eight times, or runs the same command in a circle, burning
+ * tokens while you're away. Within one turn this counts each command (or tool
+ * call) by what it is, and says so once when:
+ *
+ *   failing    the same command has failed 3 times
+ *   repeating  the exact same call has been made 5 times
+ *
+ * Pure: the runtime feeds it events and decides what to do (watchdog config).
+ */
+export const FAILING_AT = 3;
+export const REPEATING_AT = 5;
+/** "npm  test  -- --run" and "npm test -- --run" are the same call; so are two reads of one file. */
+export function signature(p) {
+    const command = typeof p.command === "string" ? p.command
+        : String(p.tool ?? "").toLowerCase() === "shell" || String(p.tool ?? "").toLowerCase() === "bash"
+            ? String(p.input?.command ?? "") : "";
+    if (command.trim())
+        return command.replace(/\s+/g, " ").trim().slice(0, 300);
+    const tool = String(p.tool ?? p.name ?? "").trim();
+    if (!tool)
+        return null;
+    return `${tool}: ${String(p.summary ?? "").replace(/\s+/g, " ").trim().slice(0, 200)}`;
+}
+export class LoopWatch {
+    turns = new Map();
+    /** One event; returns a loop the first time this turn crosses a line, else null. */
+    observe(e) {
+        if (!e.agentId)
+            return null;
+        const chat = e.chat ?? "main";
+        const key = `${e.agentId}\u0000${chat}`;
+        if (e.kind === "run_complete" || (e.kind === "status" && (e.payload.state === "interrupted" || e.payload.state === "stopped"))) {
+            this.turns.delete(key);
+            return null;
+        }
+        if (e.kind !== "tool_call")
+            return null;
+        const p = e.payload;
+        const sig = signature(p);
+        if (!sig)
+            return null;
+        let turn = this.turns.get(key);
+        if (!turn) {
+            turn = { calls: new Map(), said: new Set() };
+            this.turns.set(key, turn);
+        }
+        const c = turn.calls.get(sig) ?? { n: 0, failed: 0 };
+        c.n++;
+        const failed = (typeof p.exitCode === "number" && p.exitCode !== 0) || p.ok === false;
+        if (failed)
+            c.failed++;
+        turn.calls.set(sig, c);
+        const output = [p.output, p.preview, p.error].filter((x) => typeof x === "string" && !!x.trim()).join("\n").slice(-1500) || undefined;
+        if (failed && c.failed === FAILING_AT && !turn.said.has(`f:${sig}`)) {
+            turn.said.add(`f:${sig}`);
+            return { agentId: e.agentId, chat, kind: "failing", call: sig, count: c.failed, ...(output ? { output } : {}) };
+        }
+        if (c.n === REPEATING_AT && !turn.said.has(`f:${sig}`) && !turn.said.has(`r:${sig}`)) {
+            turn.said.add(`r:${sig}`);
+            return { agentId: e.agentId, chat, kind: "repeating", call: sig, count: c.n };
+        }
+        return null;
+    }
+    /** A person spoke in the chat: every agent's count there starts over. */
+    reset(chat) {
+        for (const k of [...this.turns.keys()])
+            if (k.endsWith(`\u0000${chat}`))
+                this.turns.delete(k);
+    }
+}
+/** What Loom tells a stuck agent when it nudges it. */
+export function nudgeText(loop) {
+    return loop.kind === "failing"
+        ? `[Loom] You've run \`${loop.call}\` ${loop.count} times this turn and it failed each time. Stop repeating it. Say in one or two sentences what is actually failing and why your fixes haven't worked, then try a different approach — or ask if you need something from me.`
+        : `[Loom] You've made the same call (\`${loop.call}\`) ${loop.count} times this turn. Step back: say what you're trying to find out, and take a different route to it.`;
+}
+//# sourceMappingURL=loops.js.map

package/dist/core/loops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loops.js","sourceRoot":"","sources":["../../src/core/loops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAC5B,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAI9B,qGAAqG;AACrG,MAAM,UAAU,SAAS,CAAC,CAA0B;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QACvD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM;YAC/F,CAAC,CAAC,MAAM,CAAE,CAAC,CAAC,KAA6C,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,IAAI,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,OAAO,SAAS;IACZ,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IAExC,oFAAoF;IACpF,OAAO,CAAC,CAAY;QAClB,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,EAAE,CAAC;YAC/H,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAkC,CAAC;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACvF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC,EAAE,CAAC;QACN,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;QACtF,IAAI,MAAM;YAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QACnJ,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClH,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC;YACrF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,IAAY;QAChB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;CACF;AAED,uDAAuD;AACvD,MAAM,UAAU,SAAS,CAAC,IAAU;IAClC,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS;QAC5B,CAAC,CAAC,uBAAuB,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,KAAK,4NAA4N;QAC9Q,CAAC,CAAC,uCAAuC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,oGAAoG,CAAC;AAC5K,CAAC"}

package/dist/core/mcp-catalog.d.ts

@@ -0,0 +1,182 @@
+/**
+ * The MCP catalog — where a server comes from before it is a row in config.
+ *
+ * core/mcp.ts is the back half of this story: it takes the servers a project has
+ * configured and puts them in front of an agent. This is the front half, and it
+ * is the half that didn't exist. Until now the only way to add a server was to
+ * know its URL and type it into a prompt — so the composer shipped six hardcoded
+ * rows with empty urls (GitHub, Slack, Supabase, …) which looked like
+ * integrations and were placeholders. A logo is not an integration, and neither
+ * is a name with nothing behind it.
+ *
+ * Two sources, and the difference between them is the whole design:
+ *
+ *   1. **The official registry** (registry.modelcontextprotocol.io). Thousands
+ *      of servers, searchable, maintained by somebody else. Everything in here
+ *      is normalised from what the registry actually returned — nothing is
+ *      filled in, and an entry that is installable by neither a URL nor a
+ *      package is dropped rather than shown as a row that can't be clicked.
+ *
+ *   2. **A curated shortlist** of well-known providers, for the empty state,
+ *      because "search 4000 servers" is a bad first screen and the registry's
+ *      ranking is not ours to reinterpret. Every URL and command in that list
+ *      was verified against the vendor's own documentation and, where it is a
+ *      remote, probed for a live response. The ones that could NOT be pinned to
+ *      a single correct endpoint carry `needsUrl` so the UI asks the user
+ *      instead of us guessing — a hosted telemetry backend whose hostname
+ *      contains the account's own region is not knowable from here.
+ *
+ * ## Why the cache exists
+ *
+ * The catalog modal searches as you type. Without a cache that is one HTTP
+ * request per keystroke against somebody else's public service, which is rude
+ * at best and rate-limited at worst. A short TTL is enough — the registry does
+ * not change between two keystrokes, and 60 seconds of staleness in a browse
+ * list costs nothing.
+ *
+ * ## Why a failed fetch is `degraded` and not an error
+ *
+ * A laptop on a plane still deserves the curated list. Returning an empty array
+ * would read as "there are no MCP servers", which is false; throwing would take
+ * the modal down over a network blip. `degraded: true` says exactly what
+ * happened — the registry did not answer, this is what we know without it — and
+ * the UI can say so out loud.
+ */
+/** How a server is spoken to. `streamable-http` from the registry maps to http. */
+export type CatalogTransport = "http" | "sse" | "stdio";
+/** One installable server, normalised out of a registry entry. */
+export interface CatalogServer {
+    /** The registry's fully-qualified name — unique and stable, e.g. `app.linear/linear`. */
+    id: string;
+    /** The same fully-qualified name. Kept because that is what the registry calls it. */
+    name: string;
+    /** A human label: the entry's own title, or the last segment of the name. */
+    title: string;
+    description: string;
+    /** The source repository, when the entry declares one. */
+    homepage?: string;
+    transport: CatalogTransport;
+    /** Set for a remote server. */
+    url?: string;
+    /** Set for a local one, derived from the published package. */
+    command?: string;
+    args?: string[];
+    /** The published version this was derived from, when the entry declares one. */
+    version?: string;
+    source: "registry";
+}
+/**
+ * One hand-verified provider for the featured shelf.
+ *
+ * Every field here is a claim somebody checked. `maintainer` is part of that:
+ * "official" means the vendor publishes this server, "community" means somebody
+ * else does — a real and important difference that the row should show, because
+ * pointing a database server at production is not a decision to make on the
+ * assumption that Postgres wrote it.
+ */
+export interface CuratedProvider {
+    /** Stable key for a bundled logo. Never changes; the display name might. */
+    slug: string;
+    /** Display name, and the name the server is installed under. */
+    name: string;
+    description: string;
+    /** The vendor's documentation for this server. */
+    homepage: string;
+    transport: CatalogTransport;
+    url?: string;
+    command?: string;
+    args?: string[];
+    /**
+     * True when the endpoint depends on the user's own account, region, or
+     * deployment and so cannot be known here. The UI must ask; it must NOT
+     * install a default. A wrong URL is worse than an empty field: it fails at
+     * handshake time with an auth error that looks like the user's fault.
+     */
+    needsUrl?: boolean;
+    /** A documented URL with the unknown part left in, to prefill what `needsUrl` asks for. */
+    urlTemplate?: string;
+    /** What the user must still supply for this server to start, in one line. */
+    requires?: string;
+    /** Does the vendor publish this server, or does somebody else? */
+    maintainer: "official" | "community";
+    source: "curated";
+}
+export interface CatalogResult {
+    /** Registry hits for the query. Empty when `degraded`. */
+    servers: CatalogServer[];
+    /** The verified shortlist. Always present — it needs no network. */
+    featured: CuratedProvider[];
+    /** True when the registry did not answer and `servers` is therefore empty. */
+    degraded: boolean;
+}
+/**
+ * Well-known providers, verified against vendor documentation.
+ *
+ * Each remote below was confirmed twice: it appears in the vendor's own docs (or
+ * in the official registry under the vendor's namespace), and a live MCP
+ * `initialize` to it answered — 401 for the ones that need auth, which is a
+ * server saying "not without credentials" and therefore proof the endpoint is
+ * real. A DNS failure or a 404 would have disqualified an entry.
+ *
+ * Three entries are worth reading the comment on rather than trusting the shape:
+ * SigNoz (region in the hostname), Postgres (no official server exists at all),
+ * and Cloudflare (sixteen servers, not one).
+ */
+export declare const CURATED_MCPS: CuratedProvider[];
+/** Drop everything cached. Exported for tests, which must not inherit a result. */
+export declare function clearCatalogCache(): void;
+/** The raw shapes the registry returns, named so the normaliser reads honestly. */
+interface RegistryRemote {
+    type?: string;
+    url?: string;
+}
+interface RegistryPackage {
+    registryType?: string;
+    identifier?: string;
+    version?: string;
+    runtimeHint?: string;
+}
+interface RegistryServer {
+    name?: string;
+    title?: string;
+    description?: string;
+    version?: string;
+    repository?: {
+        url?: string;
+    };
+    remotes?: RegistryRemote[] | null;
+    packages?: RegistryPackage[] | null;
+}
+interface RegistryEnvelope {
+    servers?: Array<{
+        server?: RegistryServer;
+        _meta?: Record<string, {
+            isLatest?: boolean;
+        }>;
+    }> | null;
+}
+/**
+ * Search the official registry, falling back to the curated shelf.
+ *
+ * `query` is passed through as the registry's own `search` parameter — its
+ * matching is its business, and reimplementing it here would give different
+ * answers than the registry's website for the same words.
+ */
+export declare function searchCatalog(query?: string, limit?: number): Promise<CatalogResult>;
+/**
+ * Registry entries → installable rows.
+ *
+ * Two things happen here that the raw response doesn't do for you:
+ *
+ *   - **Deduplication.** The registry returns every published version of a
+ *     server as its own entry, so an unfiltered list shows "inference.sh" three
+ *     times. Entries are collapsed by name, preferring the one the registry
+ *     marks `isLatest` and otherwise the last seen (the list is version-ordered).
+ *
+ *   - **Dropping the uninstallable.** `remotes` and `packages` are both nullable
+ *     and an entry can have neither — it is a name in a directory, not something
+ *     you can connect to. Those are removed rather than rendered as a row whose
+ *     Install button would have nothing to write.
+ */
+export declare function normalizeRegistry(body: RegistryEnvelope): CatalogServer[];
+export {};