@mars_ai/marscli 2.0.13 → 2.0.14

package/dist/extensions/mcp/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/extensions/mcp/oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACN,iBAAiB,EACjB,qBAAqB,IAAI,kBAAkB,EAC3C,uBAAuB,EAMvB,uBAAuB,EAGvB,cAAc,EACd,qBAAqB,GACrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAA2B,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAE7E,yGAAyG;AACzG,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,sFAAsF;AACtF,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAIlC,SAAS,WAAW,CAAC,OAA2B;IAC/C,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,eAAe,CAAC,MAAoB;IAC5C,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,SAAiB;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC;AACjE,CAAC;AAED,sGAAsG;AACtG,MAAM,OAAO,uBAAuB;IAClB,OAAO,CAAqB;IAC7C,wGAAwG;IACvF,OAAO,CAAqB;IAE7C,YAAY,OAA4B,EAAE,OAAgB;QACzD,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,CAAC;IAED,SAAS,CAAC,IAAY,EAAE,SAAiB;QACxC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,OAAO;YACN,+FAA+F;YAC/F,IAAI,EAAE,GAAG,EAAE,CACV,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;gBACjC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;gBACpC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzB,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,CAAC,CAAC;YACH,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE;gBACrB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACrB,CAAC,CAAC;YACH,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC;SACtD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAI,GAAW,EAAE,EAAoB;QACjE,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,QAAQ;aAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,IAAI,EAAE,CAAC,EAAE;YACrD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,qBAAqB;YAC5B,OAAO,EAAE;gBACR,OAAO,EAAE,oBAAoB,GAAG,qBAAqB;gBACrD,MAAM,EAAE,CAAC;gBACT,UAAU,EAAE,qBAAqB;gBACjC,UAAU,EAAE,qBAAqB;aACjC;YACD,oFAAoF;YACpF,aAAa,EAAE,GAAG,EAAE,GAAE,CAAC;SACvB,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACzB,uEAAuE;YACvE,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBACxE,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC;QACb,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC;YACJ,OAAO,MAAM,EAAE,EAAE,CAAC;QACnB,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,qHAAqH;IACrH,MAAM,CAAC,IAAY,EAAE,SAAiB;QACrC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACtF,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC;IACnD,CAAC;IAED,+GAA+G;IAC/G,MAAM,CAAC,IAAY,EAAE,SAAiB;QACrC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACxC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACjF,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAsC;QACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,CAAC,MAAM,CAAC,CAAC;YACf,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,CAAC,CAAC,CAAC;IACJ,CAAC;CACD;AAED,kGAAkG;AAClG,MAAM,4BAA4B,GAA+B;IAChE,OAAO,EAAE,sBAAsB;IAC/B,gBAAgB,EAAE,gCAAgC;CAClD,CAAC;AAEF,oDAAoD;AACpD,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,CAAC;AAElG,6GAA6G;AAC7G,SAAS,UAAU,CAAC,QAA0B;IAC7C,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,kBAAkB,IAAI,MAAM,CAAC,KAAK,MAAM,CAAC;IAChE,OAAO,IAAI,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACA,OAAO,kBAAkB,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;AACzG,CAAC;AAaD,SAAS,kBAAkB,CAAC,IAAuB;IAClD,OAAO,IAAI,CAAC,EAAE;QACb,CAAC,CAAC,gBAAgB,CAAC,2DAA2D,CAAC;QAC/E,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAOrC;IACA,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAChE,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,uBAAuB,CAAC;QAC/D,SAAS;QACT,KAAK;QACL,QAAQ;QACR,uBAAuB,EAAE,4BAA4B;QACrD,UAAU,EAAE,kBAAkB;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QAC5F,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,aAAa,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO;QAChD,MAAM,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;YAC5C,QAAQ;YACR,aAAa;YACb,oBAAoB,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,YAAY,CAAC;YACjF,MAAM;SACN,CAAC,CAAC;QACH,MAAM,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACV,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACF,CAAC","sourcesContent":["/**\n * OAuth sign-in for remote MCP servers: pi's credential store and its side of the sign-in.\n *\n * Connections never start a browser flow on their own. They send the stored access token and, after\n * a 401, try the stored refresh token. When that is not possible they fail with\n * `McpOAuthAuthorizationRequiredError`, and the user signs in through `/mcp` or `pi mcp login`, which\n * run pi-mcp's sign-in (PKCE, pi's Client ID Metadata Document or dynamic client registration) against\n * a loopback callback or a pasted redirect URL.\n *\n * Credentials live in `<agent-dir>/mcp-auth.json`, keyed by server name and URL.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { oauthErrorHtml, oauthSuccessHtml } from \"@earendil-works/pi-ai/utils/oauth-page\";\nimport { mcpNamespace } from \"@earendil-works/pi-mcp\";\nimport {\n\tcompleteMcpSignIn,\n\tcreateMcpAuthProvider as createAuthProvider,\n\tlistenForLoopbackSignIn,\n\ttype McpAuthProvider,\n\ttype McpClientMetadataDocuments,\n\ttype McpOAuthServerStore,\n\ttype McpOAuthSettings,\n\ttype McpOAuthState,\n\tMcpRefreshLockBusyError,\n\ttype OAuthCallbackPage,\n\ttype OAuthChallenge,\n\tstartMcpSignIn,\n\twaitForLoopbackSignIn,\n} from \"@earendil-works/pi-mcp/oauth\";\nimport lockfile from \"proper-lockfile\";\nimport { APP_NAME, getAgentDir } from \"../../config.ts\";\nimport { type AuthStorageBackend, FileAuthStorageBackend } from \"../../core/auth-storage.ts\";\nimport { isClientMetadataDocumentCallback } from \"../../core/mcp-servers.ts\";\n\n/** A refresh lock that its holder stopped renewing (the process was killed) is taken over after this. */\nconst REFRESH_LOCK_STALE_MS = 20_000;\n/** How long to wait for another process's refresh: longer than a stale lock lives. */\nconst REFRESH_LOCK_WAIT_MS = 25_000;\nconst REFRESH_LOCK_RETRY_MS = 100;\n\ntype StoredStates = Record<string, McpOAuthState>;\n\nfunction parseStates(content: string | undefined): StoredStates {\n\tif (!content?.trim()) return {};\n\tconst parsed: unknown = JSON.parse(content);\n\treturn typeof parsed === \"object\" && parsed !== null && !Array.isArray(parsed) ? (parsed as StoredStates) : {};\n}\n\nfunction serializeStates(states: StoredStates): string {\n\treturn `${JSON.stringify(states, null, 2)}\\n`;\n}\n\n/**\n * Keys of a server's state: by name and URL, so servers sharing a URL keep separate accounts, and the\n * legacy key by URL alone, written by older versions.\n */\nfunction storeKeys(name: string, serverUrl: string): { key: string; legacyKey: string } {\n\tconst legacyKey = String(new URL(serverUrl));\n\treturn { key: `${mcpNamespace(name)}|${legacyKey}`, legacyKey };\n}\n\n/** Per-server OAuth state (client registration, tokens, pending PKCE verifier) in `mcp-auth.json`. */\nexport class McpOAuthCredentialStore {\n\tprivate readonly backend: AuthStorageBackend;\n\t/** Directory for the refresh lock files. Without one, refreshes are only serialized in this process. */\n\tprivate readonly lockDir: string | undefined;\n\n\tconstructor(backend?: AuthStorageBackend, lockDir?: string) {\n\t\tthis.backend = backend ?? new FileAuthStorageBackend(join(getAgentDir(), \"mcp-auth.json\"));\n\t\tthis.lockDir = backend ? lockDir : getAgentDir();\n\t}\n\n\tforServer(name: string, serverUrl: string): McpOAuthServerStore {\n\t\tconst { key, legacyKey } = storeKeys(name, serverUrl);\n\t\treturn {\n\t\t\t// The first server to load legacy state takes it over; others with the same URL sign in again.\n\t\t\tload: () =>\n\t\t\t\tthis.backend.withLock((current) => {\n\t\t\t\t\tconst states = parseStates(current);\n\t\t\t\t\tif (states[key] || !states[legacyKey]) return { result: states[key] };\n\t\t\t\t\tstates[key] = states[legacyKey];\n\t\t\t\t\tdelete states[legacyKey];\n\t\t\t\t\treturn { result: states[key], next: serializeStates(states) };\n\t\t\t\t}),\n\t\t\tsave: (state) =>\n\t\t\t\tthis.write((states) => {\n\t\t\t\t\tstates[key] = state;\n\t\t\t\t}),\n\t\t\twithRefreshLock: (fn) => this.withRefreshLock(key, fn),\n\t\t};\n\t}\n\n\t/**\n\t * A lock file per server. When the process exits, proper-lockfile removes the locks it holds; when\n\t * it is killed, the lock goes stale because it is no longer renewed, and the next process takes it over.\n\t * Throws `McpRefreshLockBusyError` when another process holds the lock for the whole wait.\n\t */\n\tprivate async withRefreshLock<T>(key: string, fn: () => Promise<T>): Promise<T> {\n\t\tif (!this.lockDir) return fn();\n\t\tmkdirSync(this.lockDir, { recursive: true, mode: 0o700 });\n\t\tconst hash = createHash(\"sha256\").update(key).digest(\"hex\").slice(0, 16);\n\t\tconst release = await lockfile\n\t\t\t.lock(join(this.lockDir, `mcp-auth-refresh-${hash}`), {\n\t\t\t\trealpath: false,\n\t\t\t\tstale: REFRESH_LOCK_STALE_MS,\n\t\t\t\tretries: {\n\t\t\t\t\tretries: REFRESH_LOCK_WAIT_MS / REFRESH_LOCK_RETRY_MS,\n\t\t\t\t\tfactor: 1,\n\t\t\t\t\tminTimeout: REFRESH_LOCK_RETRY_MS,\n\t\t\t\t\tmaxTimeout: REFRESH_LOCK_RETRY_MS,\n\t\t\t\t},\n\t\t\t\t// The default throws from a timer. A lost lock at worst lets two refreshes overlap.\n\t\t\t\tonCompromised: () => {},\n\t\t\t})\n\t\t\t.catch((error: unknown) => {\n\t\t\t\t// proper-lockfile reports a lock held by another process as `ELOCKED`.\n\t\t\t\tif (error instanceof Error && \"code\" in error && error.code === \"ELOCKED\")\n\t\t\t\t\tthrow new McpRefreshLockBusyError();\n\t\t\t\tthrow error;\n\t\t\t});\n\t\ttry {\n\t\t\treturn await fn();\n\t\t} finally {\n\t\t\tawait release().catch(() => undefined);\n\t\t}\n\t}\n\n\t/** The stored tokens of a server, for noticing sign-ins done by another process. Does not take over legacy state. */\n\ttokens(name: string, serverUrl: string): McpOAuthState[\"tokens\"] {\n\t\tconst { key, legacyKey } = storeKeys(name, serverUrl);\n\t\tconst states = this.backend.withLock((current) => ({ result: parseStates(current) }));\n\t\treturn (states[key] ?? states[legacyKey])?.tokens;\n\t}\n\n\t/** Returns whether credentials were stored for the server. Removes legacy state the server would take over. */\n\tremove(name: string, serverUrl: string): boolean {\n\t\tconst { key, legacyKey } = storeKeys(name, serverUrl);\n\t\treturn this.backend.withLock((current) => {\n\t\t\tconst states = parseStates(current);\n\t\t\tconst stored = key in states ? key : legacyKey in states ? legacyKey : undefined;\n\t\t\tif (!stored) return { result: false };\n\t\t\tdelete states[stored];\n\t\t\treturn { result: true, next: serializeStates(states) };\n\t\t});\n\t}\n\n\tprivate write(update: (states: StoredStates) => void): void {\n\t\tthis.backend.withLock((current) => {\n\t\t\tconst states = parseStates(current);\n\t\t\tupdate(states);\n\t\t\treturn { result: undefined, next: serializeStates(states) };\n\t\t});\n\t}\n}\n\n/** pi's Client ID Metadata Documents on pi.dev: `client.json` and `<callback ID>/client.json`. */\nconst PI_CLIENT_METADATA_DOCUMENTS: McpClientMetadataDocuments = {\n\tbaseUrl: \"https://pi.dev/oauth\",\n\tlistsRedirectUrl: isClientMetadataDocumentCallback,\n};\n\n/** pi's client identity for sign-in and refresh. */\nconst PI_CLIENT = { clientName: APP_NAME, clientMetadataDocuments: PI_CLIENT_METADATA_DOCUMENTS };\n\n/** `settings` for pi-mcp: a rebranded build would show up as pi with pi's documents, so `auto` registers. */\nfunction piSettings(settings: McpOAuthSettings): McpOAuthSettings {\n\tconst auto = (settings.clientRegistration ?? \"auto\") === \"auto\";\n\treturn auto && APP_NAME !== \"pi\" ? { ...settings, clientRegistration: \"dcr\" } : settings;\n}\n\n/** pi-mcp's `createMcpAuthProvider` with pi's client identity. */\nexport function createMcpAuthProvider(options: {\n\tserverUrl: string;\n\tstore: McpOAuthServerStore;\n\tsettings: () => McpOAuthSettings;\n\tonChallenge: (challenge: OAuthChallenge) => void;\n}): McpAuthProvider {\n\treturn createAuthProvider({ ...options, ...PI_CLIENT, settings: () => piSettings(options.settings()) });\n}\n\nexport interface McpSignInPrompt {\n\t/** Show the authorization URL to the user and open it in a browser. */\n\tshowAuthorizationUrl(url: URL): void;\n\t/**\n\t * Ask for the redirect URL from the browser address bar, for when the browser cannot reach the\n\t * loopback callback (for example over SSH). Aborted once the callback arrives or the sign-in is\n\t * cancelled. Resolves to `undefined` or an empty string when the user cancels.\n\t */\n\tpromptForRedirectUrl(signal: AbortSignal): Promise<string | undefined>;\n}\n\nfunction renderCallbackPage(page: OAuthCallbackPage): string {\n\treturn page.ok\n\t\t? oauthSuccessHtml(\"Signed in to the MCP server. You may now close this page.\")\n\t\t: oauthErrorHtml(page.message, page.details);\n}\n\n/**\n * Sign in to an MCP server. Uses the stored refresh token when possible; otherwise runs the browser\n * authorization code flow against a loopback callback or a pasted redirect URL. Tokens are saved to\n * `store`. Aborting `signal` stops the sign-in at any step with `McpSignInCancelledError`; requests to\n * the authorization server are also time-limited.\n */\nexport async function signInMcpServer(options: {\n\tserverUrl: string;\n\tstore: McpOAuthServerStore;\n\tsettings: McpOAuthSettings;\n\tchallenge?: OAuthChallenge;\n\tprompt: McpSignInPrompt;\n\tsignal?: AbortSignal;\n}): Promise<void> {\n\tconst { serverUrl, store, challenge, prompt, signal } = options;\n\tconst settings = piSettings(options.settings);\n\tconst { callback, redirectUrl } = await listenForLoopbackSignIn({\n\t\tserverUrl,\n\t\tstore,\n\t\tsettings,\n\t\tclientMetadataDocuments: PI_CLIENT_METADATA_DOCUMENTS,\n\t\trenderPage: renderCallbackPage,\n\t});\n\ttry {\n\t\tconst signIn = { serverUrl, store, settings, redirectUrl, challenge, signal, ...PI_CLIENT };\n\t\tconst authorization = await startMcpSignIn(signIn);\n\t\tif (authorization.kind === \"authorized\") return;\n\t\tprompt.showAuthorizationUrl(new URL(authorization.authorizationUrl));\n\t\tconst response = await waitForLoopbackSignIn({\n\t\t\tcallback,\n\t\t\tauthorization,\n\t\t\tpromptForRedirectUrl: (promptSignal) => prompt.promptForRedirectUrl(promptSignal),\n\t\t\tsignal,\n\t\t});\n\t\tawait completeMcpSignIn({ ...signIn, authorization, response });\n\t} finally {\n\t\tawait callback.close();\n\t}\n}\n"]}

package/dist/extensions/mcp/resources.d.ts

@@ -0,0 +1,36 @@
+/**
+ * MCP resources, through the tools Codex and opencode use: `list_mcp_resources`,
+ * `list_mcp_resource_templates`, and `read_mcp_resource`. They take a `server` argument and cover
+ * every connected server with resources, so models trained on those tools use them unchanged.
+ *
+ * Listings are JSON, as in Codex: `{ server?, resources: [{ server, ...resource }], nextCursor? }`.
+ * With a `server`, one page is listed and `cursor` continues it; without, every page of every server.
+ * MCP App resources (`ui://` URIs and `profile=mcp-app` HTML) are left out, since they are user
+ * interfaces for hosts that render them, and so are icons. Read resources become text and images for
+ * the model; binary resources are saved to temp files. Scripts get the JSON payloads.
+ */
+import { type ListResourcesResult, type ListResourceTemplatesResult, type McpRequestOptions, type ReadResourceResult, type Resource, type ResourceTemplate } from "@earendil-works/pi-mcp";
+import type { TSchema } from "typebox";
+import type { ToolDefinition } from "../../core/extensions/types.ts";
+import { LIST_MCP_RESOURCE_TEMPLATES_TOOL, LIST_MCP_RESOURCES_TOOL, READ_MCP_RESOURCE_TOOL } from "../../core/mcp-servers.ts";
+import type { McpExposure } from "./config.ts";
+import { type McpToolDetails } from "./tools.ts";
+export { LIST_MCP_RESOURCE_TEMPLATES_TOOL, LIST_MCP_RESOURCES_TOOL, READ_MCP_RESOURCE_TOOL };
+/** A connected server that offers resources. */
+export interface McpResourceServer {
+    name: string;
+    timeoutMs: number;
+    resourcesPage(cursor: string | undefined, options: McpRequestOptions): Promise<ListResourcesResult>;
+    resourceTemplatesPage(cursor: string | undefined, options: McpRequestOptions): Promise<ListResourceTemplatesResult>;
+    allResources(options: McpRequestOptions): Promise<Resource[]>;
+    allResourceTemplates(options: McpRequestOptions): Promise<ResourceTemplate[]>;
+    readResource(uri: string, options: McpRequestOptions): Promise<ReadResourceResult>;
+}
+/**
+ * The three resource tools. `servers` returns the servers whose resources they reach, at call time.
+ */
+export declare function createMcpResourceToolDefinitions(options: {
+    exposure: McpExposure;
+    servers: () => readonly McpResourceServer[];
+}): ToolDefinition<TSchema, McpToolDetails>[];
+//# sourceMappingURL=resources.d.ts.map

package/dist/extensions/mcp/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../src/extensions/mcp/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAEN,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAEhC,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAmB,cAAc,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EACN,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,KAAK,cAAc,EAAkD,MAAM,YAAY,CAAC;AAEjG,OAAO,EAAE,gCAAgC,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAE7F,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACpG,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC9E,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACnF;AAsJD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE;IACzD,QAAQ,EAAE,WAAW,CAAC;IACtB,OAAO,EAAE,MAAM,SAAS,iBAAiB,EAAE,CAAC;CAC5C,GAAG,cAAc,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CA+I5C"}

package/dist/extensions/mcp/resources.js

@@ -0,0 +1,262 @@
+/**
+ * MCP resources, through the tools Codex and opencode use: `list_mcp_resources`,
+ * `list_mcp_resource_templates`, and `read_mcp_resource`. They take a `server` argument and cover
+ * every connected server with resources, so models trained on those tools use them unchanged.
+ *
+ * Listings are JSON, as in Codex: `{ server?, resources: [{ server, ...resource }], nextCursor? }`.
+ * With a `server`, one page is listed and `cursor` continues it; without, every page of every server.
+ * MCP App resources (`ui://` URIs and `profile=mcp-app` HTML) are left out, since they are user
+ * interfaces for hosts that render them, and so are icons. Read resources become text and images for
+ * the model; binary resources are saved to temp files. Scripts get the JSON payloads.
+ */
+import { limitMcpContent, } from "@earendil-works/pi-mcp";
+import { LIST_MCP_RESOURCE_TEMPLATES_TOOL, LIST_MCP_RESOURCES_TOOL, READ_MCP_RESOURCE_TOOL, } from "../../core/mcp-servers.js";
+import { saveToTempFile, toModelContent, toToolExposure } from "./tools.js";
+export { LIST_MCP_RESOURCE_TEMPLATES_TOOL, LIST_MCP_RESOURCES_TOOL, READ_MCP_RESOURCE_TOOL };
+/** MCP App user interfaces, which only hosts that render them can use. */
+function isMcpAppResource(item) {
+    const uri = item.uri ?? item.uriTemplate ?? "";
+    return uri.startsWith("ui://") || /;\s*profile\s*=\s*"?mcp-app"?/i.test(item.mimeType ?? "");
+}
+/** A listed resource or template without `_meta` and icons, tagged with its server. */
+function listed(server, item) {
+    const { _meta, icons: _icons, ...rest } = item;
+    return { server, ...rest };
+}
+const stringProperty = (description) => ({ type: "string", description });
+const SERVER_FILTER = stringProperty("MCP server name. Omit to list every server with resources.");
+const CURSOR = stringProperty("Opaque cursor from a previous call with the same server; omit for the first page.");
+const LIST_PARAMETERS = {
+    type: "object",
+    properties: { server: SERVER_FILTER, cursor: CURSOR },
+    additionalProperties: false,
+};
+const READ_PARAMETERS = {
+    type: "object",
+    properties: {
+        server: stringProperty("MCP server name exactly as configured. Must match the 'server' field returned by list_mcp_resources."),
+        uri: stringProperty("Resource URI to read. Must be one of the URIs returned by list_mcp_resources."),
+    },
+    required: ["server", "uri"],
+    additionalProperties: false,
+};
+const optionalString = { type: "string" };
+const LISTING_ERRORS = {
+    type: "array",
+    description: "Servers that could not be listed",
+    items: {
+        type: "object",
+        properties: { server: { type: "string" }, error: { type: "string" } },
+        required: ["server", "error"],
+    },
+};
+const LIST_OUTPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        server: optionalString,
+        resources: {
+            type: "array",
+            items: {
+                type: "object",
+                properties: {
+                    server: { type: "string" },
+                    uri: { type: "string" },
+                    name: { type: "string" },
+                    title: optionalString,
+                    description: optionalString,
+                    mimeType: optionalString,
+                    size: { type: "number" },
+                },
+                required: ["server", "uri", "name"],
+            },
+        },
+        nextCursor: optionalString,
+        errors: LISTING_ERRORS,
+    },
+    required: ["resources"],
+};
+const LIST_TEMPLATES_OUTPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        server: optionalString,
+        resourceTemplates: {
+            type: "array",
+            items: {
+                type: "object",
+                properties: {
+                    server: { type: "string" },
+                    uriTemplate: { type: "string", description: "RFC 6570 URI template" },
+                    name: { type: "string" },
+                    title: optionalString,
+                    description: optionalString,
+                    mimeType: optionalString,
+                },
+                required: ["server", "uriTemplate", "name"],
+            },
+        },
+        nextCursor: optionalString,
+        errors: LISTING_ERRORS,
+    },
+    required: ["resourceTemplates"],
+};
+const READ_OUTPUT_SCHEMA = {
+    type: "object",
+    properties: {
+        server: { type: "string" },
+        uri: { type: "string" },
+        contents: {
+            type: "array",
+            items: {
+                anyOf: [
+                    {
+                        type: "object",
+                        properties: { uri: { type: "string" }, mimeType: optionalString, text: { type: "string" } },
+                        required: ["uri", "text"],
+                    },
+                    {
+                        type: "object",
+                        properties: {
+                            uri: { type: "string" },
+                            mimeType: optionalString,
+                            blob: { type: "string", description: "base64" },
+                        },
+                        required: ["uri", "blob"],
+                    },
+                ],
+            },
+        },
+    },
+    required: ["server", "uri", "contents"],
+};
+function stringArgument(params, key) {
+    const value = params?.[key];
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== "string")
+        throw new Error(`${key} must be a string`);
+    return value.trim() || undefined;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+async function jsonResult(tool, server, payload) {
+    const { content, fullOutputPath } = await limitMcpContent([{ type: "text", text: JSON.stringify(payload) }], saveToTempFile);
+    return {
+        content,
+        details: { server: server ?? "", tool, ...(fullOutputPath ? { fullOutputPath } : {}) },
+        structuredContent: payload,
+    };
+}
+/**
+ * The three resource tools. `servers` returns the servers whose resources they reach, at call time.
+ */
+export function createMcpResourceToolDefinitions(options) {
+    const readOnly = { readOnlyHint: true };
+    const findServer = (name) => {
+        const servers = options.servers();
+        const server = servers.find((candidate) => candidate.name === name);
+        if (server)
+            return server;
+        const available = servers.map((candidate) => candidate.name).join(", ");
+        throw new Error(`MCP server "${name}" has no resources${available ? `. Servers with resources: ${available}` : ""}`);
+    };
+    /** One page of one server, or every page of every server. */
+    const list = async (params, signal, key, page, all) => {
+        const serverName = stringArgument(params, "server");
+        const cursor = stringArgument(params, "cursor");
+        const visible = (item) => !isMcpAppResource(item);
+        if (serverName) {
+            const server = findServer(serverName);
+            const result = await page(server, cursor, { signal, timeoutMs: server.timeoutMs });
+            return {
+                server: server.name,
+                [key]: result.items.filter(visible).map((item) => listed(server.name, item)),
+                ...(result.nextCursor === undefined ? {} : { nextCursor: result.nextCursor }),
+            };
+        }
+        if (cursor)
+            throw new Error("cursor can only be used when a server is specified");
+        const servers = [...options.servers()].sort((a, b) => a.name.localeCompare(b.name));
+        const results = await Promise.allSettled(servers.map((server) => all(server, { signal, timeoutMs: server.timeoutMs })));
+        const items = [];
+        const errors = [];
+        results.forEach((result, index) => {
+            const server = servers[index].name;
+            if (result.status === "fulfilled")
+                items.push(...result.value.filter(visible).map((item) => listed(server, item)));
+            else
+                errors.push({ server, error: errorMessage(result.reason) });
+        });
+        return { [key]: items, ...(errors.length > 0 ? { errors } : {}) };
+    };
+    const listResources = {
+        name: LIST_MCP_RESOURCES_TOOL,
+        label: LIST_MCP_RESOURCES_TOOL,
+        description: "Lists resources provided by MCP servers. Resources allow servers to share data that provides context to language models, such as files, database schemas, or application-specific information. Prefer resources over web search when possible.",
+        parameters: LIST_PARAMETERS,
+        outputSchema: LIST_OUTPUT_SCHEMA,
+        exposure: toToolExposure(options.exposure),
+        annotations: readOnly,
+        async execute(_toolCallId, params, signal) {
+            const payload = await list(params, signal, "resources", async (server, cursor, requestOptions) => {
+                const result = await server.resourcesPage(cursor, requestOptions);
+                return { items: result.resources, nextCursor: result.nextCursor };
+            }, (server, requestOptions) => server.allResources(requestOptions));
+            return jsonResult(LIST_MCP_RESOURCES_TOOL, stringArgument(params, "server"), payload);
+        },
+    };
+    const listTemplates = {
+        name: LIST_MCP_RESOURCE_TEMPLATES_TOOL,
+        label: LIST_MCP_RESOURCE_TEMPLATES_TOOL,
+        description: "Lists resource templates provided by MCP servers. Parameterized resource templates allow servers to share data that takes parameters and provides context to language models, such as files, database schemas, or application-specific information. Prefer resource templates over web search when possible.",
+        parameters: LIST_PARAMETERS,
+        outputSchema: LIST_TEMPLATES_OUTPUT_SCHEMA,
+        exposure: toToolExposure(options.exposure),
+        annotations: readOnly,
+        async execute(_toolCallId, params, signal) {
+            const payload = await list(params, signal, "resourceTemplates", async (server, cursor, requestOptions) => {
+                const result = await server.resourceTemplatesPage(cursor, requestOptions);
+                return { items: result.resourceTemplates, nextCursor: result.nextCursor };
+            }, (server, requestOptions) => server.allResourceTemplates(requestOptions));
+            return jsonResult(LIST_MCP_RESOURCE_TEMPLATES_TOOL, stringArgument(params, "server"), payload);
+        },
+    };
+    const readResource = {
+        name: READ_MCP_RESOURCE_TOOL,
+        label: READ_MCP_RESOURCE_TOOL,
+        description: "Read a specific resource from an MCP server given the server name and resource URI.",
+        parameters: READ_PARAMETERS,
+        outputSchema: READ_OUTPUT_SCHEMA,
+        exposure: toToolExposure(options.exposure),
+        annotations: readOnly,
+        async execute(_toolCallId, params, signal) {
+            const serverName = stringArgument(params, "server");
+            const uri = stringArgument(params, "uri");
+            if (!serverName)
+                throw new Error("server must be provided");
+            if (!uri)
+                throw new Error("uri must be provided");
+            const server = findServer(serverName);
+            const result = await server.readResource(uri, { signal, timeoutMs: server.timeoutMs });
+            // Several contents (for example a directory) are labeled with their URIs.
+            const blocks = result.contents.flatMap((contents) => [
+                ...(result.contents.length > 1 ? [{ type: "text", text: `${contents.uri}:` }] : []),
+                { type: "resource", resource: contents },
+            ]);
+            const converted = await toModelContent(server.name, blocks);
+            const { content, fullOutputPath } = await limitMcpContent(converted.length > 0 ? converted : [{ type: "text", text: `Resource ${uri} is empty.` }], saveToTempFile);
+            const contents = result.contents.map(({ _meta: _ignored, ...rest }) => rest);
+            return {
+                content,
+                details: {
+                    server: server.name,
+                    tool: READ_MCP_RESOURCE_TOOL,
+                    ...(fullOutputPath ? { fullOutputPath } : {}),
+                },
+                structuredContent: { server: server.name, uri, contents },
+            };
+        },
+    };
+    return [listResources, listTemplates, readResource];
+}
+//# sourceMappingURL=resources.js.map

package/dist/extensions/mcp/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../../src/extensions/mcp/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAIN,eAAe,GAKf,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACN,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAuB,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjG,OAAO,EAAE,gCAAgC,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAa7F,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,IAA+D;IACxF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IAC/C,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,uFAAuF;AACvF,SAAS,MAAM,CAAgC,MAAc,EAAE,IAAO;IACrE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;IAC1E,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;AAClF,MAAM,aAAa,GAAG,cAAc,CAAC,4DAA4D,CAAC,CAAC;AACnG,MAAM,MAAM,GAAG,cAAc,CAAC,mFAAmF,CAAC,CAAC;AACnH,MAAM,eAAe,GAAG;IACvB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE;IACrD,oBAAoB,EAAE,KAAK;CAC3B,CAAC;AACF,MAAM,eAAe,GAAG;IACvB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACX,MAAM,EAAE,cAAc,CACrB,sGAAsG,CACtG;QACD,GAAG,EAAE,cAAc,CAAC,+EAA+E,CAAC;KACpG;IACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;IAC3B,oBAAoB,EAAE,KAAK;CAC3B,CAAC;AAEF,MAAM,cAAc,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC1C,MAAM,cAAc,GAAG;IACtB,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,kCAAkC;IAC/C,KAAK,EAAE;QACN,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACrE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;KAC7B;CACD,CAAC;AACF,MAAM,kBAAkB,GAAG;IAC1B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACX,MAAM,EAAE,cAAc;QACtB,SAAS,EAAE;YACV,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACvB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,KAAK,EAAE,cAAc;oBACrB,WAAW,EAAE,cAAc;oBAC3B,QAAQ,EAAE,cAAc;oBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBACxB;gBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC;aACnC;SACD;QACD,UAAU,EAAE,cAAc;QAC1B,MAAM,EAAE,cAAc;KACtB;IACD,QAAQ,EAAE,CAAC,WAAW,CAAC;CACvB,CAAC;AACF,MAAM,4BAA4B,GAAG;IACpC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACX,MAAM,EAAE,cAAc;QACtB,iBAAiB,EAAE;YAClB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE;oBACrE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,KAAK,EAAE,cAAc;oBACrB,WAAW,EAAE,cAAc;oBAC3B,QAAQ,EAAE,cAAc;iBACxB;gBACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC;aAC3C;SACD;QACD,UAAU,EAAE,cAAc;QAC1B,MAAM,EAAE,cAAc;KACtB;IACD,QAAQ,EAAE,CAAC,mBAAmB,CAAC;CAC/B,CAAC;AACF,MAAM,kBAAkB,GAAG;IAC1B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC1B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,QAAQ,EAAE;YACT,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACN,KAAK,EAAE;oBACN;wBACC,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;wBAC3F,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;qBACzB;oBACD;wBACC,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE;4BACX,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BACvB,QAAQ,EAAE,cAAc;4BACxB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;yBAC/C;wBACD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC;qBACzB;iBACD;aACD;SACD;KACD;IACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC;CACvC,CAAC;AAEF,SAAS,cAAc,CAAC,MAAe,EAAE,GAAW;IACnD,MAAM,KAAK,GAAI,MAA8C,EAAE,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,IAAY,EACZ,MAA0B,EAC1B,OAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,eAAe,CACxD,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EACjD,cAAc,CACd,CAAC;IACF,OAAO;QACN,OAAO;QACP,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACtF,iBAAiB,EAAE,OAA+B;KAClD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAGhD;IACA,MAAM,QAAQ,GAAoB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAEzD,MAAM,UAAU,GAAG,CAAC,IAAY,EAAqB,EAAE;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACpE,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CACd,eAAe,IAAI,qBAAqB,SAAS,CAAC,CAAC,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACnG,CAAC;IACH,CAAC,CAAC;IAEF,6DAA6D;IAC7D,MAAM,IAAI,GAAG,KAAK,EACjB,MAAe,EACf,MAA+B,EAC/B,GAAsC,EACtC,IAOE,EACF,GAA4E,EACzC,EAAE;QACrC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,CAAC,IAAO,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAiE,CAAC,CAAC;QAClH,IAAI,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACnF,OAAO;gBACN,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAC5E,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;aAC7E,CAAC;QACH,CAAC;QACD,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACvC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAC7E,CAAC;QACF,MAAM,KAAK,GAA8B,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAwC,EAAE,CAAC;QACvD,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;YACnC,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;gBAChC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;;gBAC5E,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACnE,CAAC,CAAC;IAEF,MAAM,aAAa,GAA4C;QAC9D,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACV,gPAAgP;QACjP,UAAU,EAAE,eAAqC;QACjD,YAAY,EAAE,kBAAwC;QACtD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,WAAW,EAAE,QAAQ;QACrB,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM;YACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CACzB,MAAM,EACN,MAAM,EACN,WAAW,EACX,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE;gBACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBAClE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;YACnE,CAAC,EACD,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,CAC/D,CAAC;YACF,OAAO,UAAU,CAAC,uBAAuB,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,CAAC;KACD,CAAC;IAEF,MAAM,aAAa,GAA4C;QAC9D,IAAI,EAAE,gCAAgC;QACtC,KAAK,EAAE,gCAAgC;QACvC,WAAW,EACV,8SAA8S;QAC/S,UAAU,EAAE,eAAqC;QACjD,YAAY,EAAE,4BAAkD;QAChE,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,WAAW,EAAE,QAAQ;QACrB,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM;YACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CACzB,MAAM,EACN,MAAM,EACN,mBAAmB,EACnB,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE;gBACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBAC1E,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3E,CAAC,EACD,CAAC,MAAM,EAAE,cAAc,EAAE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,CACvE,CAAC;YACF,OAAO,UAAU,CAAC,gCAAgC,EAAE,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QAChG,CAAC;KACD,CAAC;IAEF,MAAM,YAAY,GAA4C;QAC7D,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,qFAAqF;QAClG,UAAU,EAAE,eAAqC;QACjD,YAAY,EAAE,kBAAwC;QACtD,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1C,WAAW,EAAE,QAAQ;QACrB,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM;YACxC,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC1C,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC5D,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,0EAA0E;YAC1E,MAAM,MAAM,GAAmB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,EAAE,IAAI,EAAE,UAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE;aACjD,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,eAAe,CACxD,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,YAAY,EAAE,CAAC,EACxF,cAAc,CACd,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC7E,OAAO;gBACN,OAAO;gBACP,OAAO,EAAE;oBACR,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,IAAI,EAAE,sBAAsB;oBAC5B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7C;gBACD,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAA0B;aACjF,CAAC;QACH,CAAC;KACD,CAAC;IAEF,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AACrD,CAAC","sourcesContent":["/**\n * MCP resources, through the tools Codex and opencode use: `list_mcp_resources`,\n * `list_mcp_resource_templates`, and `read_mcp_resource`. They take a `server` argument and cover\n * every connected server with resources, so models trained on those tools use them unchanged.\n *\n * Listings are JSON, as in Codex: `{ server?, resources: [{ server, ...resource }], nextCursor? }`.\n * With a `server`, one page is listed and `cursor` continues it; without, every page of every server.\n * MCP App resources (`ui://` URIs and `profile=mcp-app` HTML) are left out, since they are user\n * interfaces for hosts that render them, and so are icons. Read resources become text and images for\n * the model; binary resources are saved to temp files. Scripts get the JSON payloads.\n */\n\nimport type { ImageContent, JsonValue, TextContent } from \"@earendil-works/pi-ai\";\nimport {\n\ttype ContentBlock,\n\ttype ListResourcesResult,\n\ttype ListResourceTemplatesResult,\n\tlimitMcpContent,\n\ttype McpRequestOptions,\n\ttype ReadResourceResult,\n\ttype Resource,\n\ttype ResourceTemplate,\n} from \"@earendil-works/pi-mcp\";\nimport type { TSchema } from \"typebox\";\nimport type { ToolAnnotations, ToolDefinition } from \"../../core/extensions/types.ts\";\nimport {\n\tLIST_MCP_RESOURCE_TEMPLATES_TOOL,\n\tLIST_MCP_RESOURCES_TOOL,\n\tREAD_MCP_RESOURCE_TOOL,\n} from \"../../core/mcp-servers.ts\";\nimport type { McpExposure } from \"./config.ts\";\nimport { type McpToolDetails, saveToTempFile, toModelContent, toToolExposure } from \"./tools.ts\";\n\nexport { LIST_MCP_RESOURCE_TEMPLATES_TOOL, LIST_MCP_RESOURCES_TOOL, READ_MCP_RESOURCE_TOOL };\n\n/** A connected server that offers resources. */\nexport interface McpResourceServer {\n\tname: string;\n\ttimeoutMs: number;\n\tresourcesPage(cursor: string | undefined, options: McpRequestOptions): Promise<ListResourcesResult>;\n\tresourceTemplatesPage(cursor: string | undefined, options: McpRequestOptions): Promise<ListResourceTemplatesResult>;\n\tallResources(options: McpRequestOptions): Promise<Resource[]>;\n\tallResourceTemplates(options: McpRequestOptions): Promise<ResourceTemplate[]>;\n\treadResource(uri: string, options: McpRequestOptions): Promise<ReadResourceResult>;\n}\n\n/** MCP App user interfaces, which only hosts that render them can use. */\nfunction isMcpAppResource(item: { uri?: string; uriTemplate?: string; mimeType?: string }): boolean {\n\tconst uri = item.uri ?? item.uriTemplate ?? \"\";\n\treturn uri.startsWith(\"ui://\") || /;\\s*profile\\s*=\\s*\"?mcp-app\"?/i.test(item.mimeType ?? \"\");\n}\n\n/** A listed resource or template without `_meta` and icons, tagged with its server. */\nfunction listed<T extends { _meta?: unknown }>(server: string, item: T): Record<string, unknown> {\n\tconst { _meta, icons: _icons, ...rest } = item as T & { icons?: unknown };\n\treturn { server, ...rest };\n}\n\nconst stringProperty = (description: string) => ({ type: \"string\", description });\nconst SERVER_FILTER = stringProperty(\"MCP server name. Omit to list every server with resources.\");\nconst CURSOR = stringProperty(\"Opaque cursor from a previous call with the same server; omit for the first page.\");\nconst LIST_PARAMETERS = {\n\ttype: \"object\",\n\tproperties: { server: SERVER_FILTER, cursor: CURSOR },\n\tadditionalProperties: false,\n};\nconst READ_PARAMETERS = {\n\ttype: \"object\",\n\tproperties: {\n\t\tserver: stringProperty(\n\t\t\t\"MCP server name exactly as configured. Must match the 'server' field returned by list_mcp_resources.\",\n\t\t),\n\t\turi: stringProperty(\"Resource URI to read. Must be one of the URIs returned by list_mcp_resources.\"),\n\t},\n\trequired: [\"server\", \"uri\"],\n\tadditionalProperties: false,\n};\n\nconst optionalString = { type: \"string\" };\nconst LISTING_ERRORS = {\n\ttype: \"array\",\n\tdescription: \"Servers that could not be listed\",\n\titems: {\n\t\ttype: \"object\",\n\t\tproperties: { server: { type: \"string\" }, error: { type: \"string\" } },\n\t\trequired: [\"server\", \"error\"],\n\t},\n};\nconst LIST_OUTPUT_SCHEMA = {\n\ttype: \"object\",\n\tproperties: {\n\t\tserver: optionalString,\n\t\tresources: {\n\t\t\ttype: \"array\",\n\t\t\titems: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: {\n\t\t\t\t\tserver: { type: \"string\" },\n\t\t\t\t\turi: { type: \"string\" },\n\t\t\t\t\tname: { type: \"string\" },\n\t\t\t\t\ttitle: optionalString,\n\t\t\t\t\tdescription: optionalString,\n\t\t\t\t\tmimeType: optionalString,\n\t\t\t\t\tsize: { type: \"number\" },\n\t\t\t\t},\n\t\t\t\trequired: [\"server\", \"uri\", \"name\"],\n\t\t\t},\n\t\t},\n\t\tnextCursor: optionalString,\n\t\terrors: LISTING_ERRORS,\n\t},\n\trequired: [\"resources\"],\n};\nconst LIST_TEMPLATES_OUTPUT_SCHEMA = {\n\ttype: \"object\",\n\tproperties: {\n\t\tserver: optionalString,\n\t\tresourceTemplates: {\n\t\t\ttype: \"array\",\n\t\t\titems: {\n\t\t\t\ttype: \"object\",\n\t\t\t\tproperties: {\n\t\t\t\t\tserver: { type: \"string\" },\n\t\t\t\t\turiTemplate: { type: \"string\", description: \"RFC 6570 URI template\" },\n\t\t\t\t\tname: { type: \"string\" },\n\t\t\t\t\ttitle: optionalString,\n\t\t\t\t\tdescription: optionalString,\n\t\t\t\t\tmimeType: optionalString,\n\t\t\t\t},\n\t\t\t\trequired: [\"server\", \"uriTemplate\", \"name\"],\n\t\t\t},\n\t\t},\n\t\tnextCursor: optionalString,\n\t\terrors: LISTING_ERRORS,\n\t},\n\trequired: [\"resourceTemplates\"],\n};\nconst READ_OUTPUT_SCHEMA = {\n\ttype: \"object\",\n\tproperties: {\n\t\tserver: { type: \"string\" },\n\t\turi: { type: \"string\" },\n\t\tcontents: {\n\t\t\ttype: \"array\",\n\t\t\titems: {\n\t\t\t\tanyOf: [\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\tproperties: { uri: { type: \"string\" }, mimeType: optionalString, text: { type: \"string\" } },\n\t\t\t\t\t\trequired: [\"uri\", \"text\"],\n\t\t\t\t\t},\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: \"object\",\n\t\t\t\t\t\tproperties: {\n\t\t\t\t\t\t\turi: { type: \"string\" },\n\t\t\t\t\t\t\tmimeType: optionalString,\n\t\t\t\t\t\t\tblob: { type: \"string\", description: \"base64\" },\n\t\t\t\t\t\t},\n\t\t\t\t\t\trequired: [\"uri\", \"blob\"],\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t},\n\t\t},\n\t},\n\trequired: [\"server\", \"uri\", \"contents\"],\n};\n\nfunction stringArgument(params: unknown, key: string): string | undefined {\n\tconst value = (params as Record<string, unknown> | undefined)?.[key];\n\tif (value === undefined || value === null) return undefined;\n\tif (typeof value !== \"string\") throw new Error(`${key} must be a string`);\n\treturn value.trim() || undefined;\n}\n\nfunction errorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nasync function jsonResult(\n\ttool: string,\n\tserver: string | undefined,\n\tpayload: Record<string, unknown>,\n): Promise<{ content: (TextContent | ImageContent)[]; details: McpToolDetails; structuredContent: JsonValue }> {\n\tconst { content, fullOutputPath } = await limitMcpContent(\n\t\t[{ type: \"text\", text: JSON.stringify(payload) }],\n\t\tsaveToTempFile,\n\t);\n\treturn {\n\t\tcontent,\n\t\tdetails: { server: server ?? \"\", tool, ...(fullOutputPath ? { fullOutputPath } : {}) },\n\t\tstructuredContent: payload as unknown as JsonValue,\n\t};\n}\n\n/**\n * The three resource tools. `servers` returns the servers whose resources they reach, at call time.\n */\nexport function createMcpResourceToolDefinitions(options: {\n\texposure: McpExposure;\n\tservers: () => readonly McpResourceServer[];\n}): ToolDefinition<TSchema, McpToolDetails>[] {\n\tconst readOnly: ToolAnnotations = { readOnlyHint: true };\n\n\tconst findServer = (name: string): McpResourceServer => {\n\t\tconst servers = options.servers();\n\t\tconst server = servers.find((candidate) => candidate.name === name);\n\t\tif (server) return server;\n\t\tconst available = servers.map((candidate) => candidate.name).join(\", \");\n\t\tthrow new Error(\n\t\t\t`MCP server \"${name}\" has no resources${available ? `. Servers with resources: ${available}` : \"\"}`,\n\t\t);\n\t};\n\n\t/** One page of one server, or every page of every server. */\n\tconst list = async <T extends { _meta?: unknown }>(\n\t\tparams: unknown,\n\t\tsignal: AbortSignal | undefined,\n\t\tkey: \"resources\" | \"resourceTemplates\",\n\t\tpage: (\n\t\t\tserver: McpResourceServer,\n\t\t\tcursor: string | undefined,\n\t\t\toptions: McpRequestOptions,\n\t\t) => Promise<{\n\t\t\titems: T[];\n\t\t\tnextCursor?: string;\n\t\t}>,\n\t\tall: (server: McpResourceServer, options: McpRequestOptions) => Promise<T[]>,\n\t): Promise<Record<string, unknown>> => {\n\t\tconst serverName = stringArgument(params, \"server\");\n\t\tconst cursor = stringArgument(params, \"cursor\");\n\t\tconst visible = (item: T) => !isMcpAppResource(item as { uri?: string; uriTemplate?: string; mimeType?: string });\n\t\tif (serverName) {\n\t\t\tconst server = findServer(serverName);\n\t\t\tconst result = await page(server, cursor, { signal, timeoutMs: server.timeoutMs });\n\t\t\treturn {\n\t\t\t\tserver: server.name,\n\t\t\t\t[key]: result.items.filter(visible).map((item) => listed(server.name, item)),\n\t\t\t\t...(result.nextCursor === undefined ? {} : { nextCursor: result.nextCursor }),\n\t\t\t};\n\t\t}\n\t\tif (cursor) throw new Error(\"cursor can only be used when a server is specified\");\n\t\tconst servers = [...options.servers()].sort((a, b) => a.name.localeCompare(b.name));\n\t\tconst results = await Promise.allSettled(\n\t\t\tservers.map((server) => all(server, { signal, timeoutMs: server.timeoutMs })),\n\t\t);\n\t\tconst items: Record<string, unknown>[] = [];\n\t\tconst errors: { server: string; error: string }[] = [];\n\t\tresults.forEach((result, index) => {\n\t\t\tconst server = servers[index].name;\n\t\t\tif (result.status === \"fulfilled\")\n\t\t\t\titems.push(...result.value.filter(visible).map((item) => listed(server, item)));\n\t\t\telse errors.push({ server, error: errorMessage(result.reason) });\n\t\t});\n\t\treturn { [key]: items, ...(errors.length > 0 ? { errors } : {}) };\n\t};\n\n\tconst listResources: ToolDefinition<TSchema, McpToolDetails> = {\n\t\tname: LIST_MCP_RESOURCES_TOOL,\n\t\tlabel: LIST_MCP_RESOURCES_TOOL,\n\t\tdescription:\n\t\t\t\"Lists resources provided by MCP servers. Resources allow servers to share data that provides context to language models, such as files, database schemas, or application-specific information. Prefer resources over web search when possible.\",\n\t\tparameters: LIST_PARAMETERS as unknown as TSchema,\n\t\toutputSchema: LIST_OUTPUT_SCHEMA as unknown as TSchema,\n\t\texposure: toToolExposure(options.exposure),\n\t\tannotations: readOnly,\n\t\tasync execute(_toolCallId, params, signal) {\n\t\t\tconst payload = await list(\n\t\t\t\tparams,\n\t\t\t\tsignal,\n\t\t\t\t\"resources\",\n\t\t\t\tasync (server, cursor, requestOptions) => {\n\t\t\t\t\tconst result = await server.resourcesPage(cursor, requestOptions);\n\t\t\t\t\treturn { items: result.resources, nextCursor: result.nextCursor };\n\t\t\t\t},\n\t\t\t\t(server, requestOptions) => server.allResources(requestOptions),\n\t\t\t);\n\t\t\treturn jsonResult(LIST_MCP_RESOURCES_TOOL, stringArgument(params, \"server\"), payload);\n\t\t},\n\t};\n\n\tconst listTemplates: ToolDefinition<TSchema, McpToolDetails> = {\n\t\tname: LIST_MCP_RESOURCE_TEMPLATES_TOOL,\n\t\tlabel: LIST_MCP_RESOURCE_TEMPLATES_TOOL,\n\t\tdescription:\n\t\t\t\"Lists resource templates provided by MCP servers. Parameterized resource templates allow servers to share data that takes parameters and provides context to language models, such as files, database schemas, or application-specific information. Prefer resource templates over web search when possible.\",\n\t\tparameters: LIST_PARAMETERS as unknown as TSchema,\n\t\toutputSchema: LIST_TEMPLATES_OUTPUT_SCHEMA as unknown as TSchema,\n\t\texposure: toToolExposure(options.exposure),\n\t\tannotations: readOnly,\n\t\tasync execute(_toolCallId, params, signal) {\n\t\t\tconst payload = await list(\n\t\t\t\tparams,\n\t\t\t\tsignal,\n\t\t\t\t\"resourceTemplates\",\n\t\t\t\tasync (server, cursor, requestOptions) => {\n\t\t\t\t\tconst result = await server.resourceTemplatesPage(cursor, requestOptions);\n\t\t\t\t\treturn { items: result.resourceTemplates, nextCursor: result.nextCursor };\n\t\t\t\t},\n\t\t\t\t(server, requestOptions) => server.allResourceTemplates(requestOptions),\n\t\t\t);\n\t\t\treturn jsonResult(LIST_MCP_RESOURCE_TEMPLATES_TOOL, stringArgument(params, \"server\"), payload);\n\t\t},\n\t};\n\n\tconst readResource: ToolDefinition<TSchema, McpToolDetails> = {\n\t\tname: READ_MCP_RESOURCE_TOOL,\n\t\tlabel: READ_MCP_RESOURCE_TOOL,\n\t\tdescription: \"Read a specific resource from an MCP server given the server name and resource URI.\",\n\t\tparameters: READ_PARAMETERS as unknown as TSchema,\n\t\toutputSchema: READ_OUTPUT_SCHEMA as unknown as TSchema,\n\t\texposure: toToolExposure(options.exposure),\n\t\tannotations: readOnly,\n\t\tasync execute(_toolCallId, params, signal) {\n\t\t\tconst serverName = stringArgument(params, \"server\");\n\t\t\tconst uri = stringArgument(params, \"uri\");\n\t\t\tif (!serverName) throw new Error(\"server must be provided\");\n\t\t\tif (!uri) throw new Error(\"uri must be provided\");\n\t\t\tconst server = findServer(serverName);\n\t\t\tconst result = await server.readResource(uri, { signal, timeoutMs: server.timeoutMs });\n\t\t\t// Several contents (for example a directory) are labeled with their URIs.\n\t\t\tconst blocks: ContentBlock[] = result.contents.flatMap((contents) => [\n\t\t\t\t...(result.contents.length > 1 ? [{ type: \"text\" as const, text: `${contents.uri}:` }] : []),\n\t\t\t\t{ type: \"resource\" as const, resource: contents },\n\t\t\t]);\n\t\t\tconst converted = await toModelContent(server.name, blocks);\n\t\t\tconst { content, fullOutputPath } = await limitMcpContent(\n\t\t\t\tconverted.length > 0 ? converted : [{ type: \"text\", text: `Resource ${uri} is empty.` }],\n\t\t\t\tsaveToTempFile,\n\t\t\t);\n\t\t\tconst contents = result.contents.map(({ _meta: _ignored, ...rest }) => rest);\n\t\t\treturn {\n\t\t\t\tcontent,\n\t\t\t\tdetails: {\n\t\t\t\t\tserver: server.name,\n\t\t\t\t\ttool: READ_MCP_RESOURCE_TOOL,\n\t\t\t\t\t...(fullOutputPath ? { fullOutputPath } : {}),\n\t\t\t\t},\n\t\t\t\tstructuredContent: { server: server.name, uri, contents } as unknown as JsonValue,\n\t\t\t};\n\t\t},\n\t};\n\n\treturn [listResources, listTemplates, readResource];\n}\n"]}

package/dist/extensions/mcp/runtime.d.ts

@@ -0,0 +1,99 @@
+/**
+ * The part of the MCP integration that talks to servers: connections, transports, and OAuth
+ * sign-in. It pulls in the MCP client, so index.ts loads it through runtime.lazy.ts only when a
+ * server is configured.
+ */
+import { type AuthProvider, type CallToolResult, type ListResourcesResult, type ListResourceTemplatesResult, McpClient, type McpRequestOptions, type Tool as McpTool, type McpTransport, type ReadResourceResult, type Resource, type ResourceTemplate } from "@earendil-works/pi-mcp";
+import { type McpOAuthSettings, type OAuthChallenge } from "@earendil-works/pi-mcp/oauth";
+import type { McpServerEntry } from "./config.ts";
+import type { McpServerLog } from "./log.ts";
+import { type McpOAuthCredentialStore } from "./oauth.ts";
+import type { McpResourceServer } from "./resources.ts";
+import type { McpToolCaller } from "./tools.ts";
+export { McpSignInCancelledError } from "@earendil-works/pi-mcp/oauth";
+export { McpServerLog } from "./log.ts";
+export { McpOAuthCredentialStore, signInMcpServer } from "./oauth.ts";
+/**
+ * `disconnected`: the connection dropped (for example the stdio server exited); the next call
+ * reconnects.
+ */
+type ServerState = "connecting" | "connected" | "disconnected" | "needs-auth" | "failed" | "closed";
+export type McpTransportFactory = (entry: McpServerEntry, cwd: string, authProvider: AuthProvider | undefined) => McpTransport;
+export declare function createDefaultTransport(entry: McpServerEntry, cwd: string, authProvider: AuthProvider | undefined): McpTransport;
+/** One configured server. Reconnects lazily when a call finds the connection gone. */
+export declare class McpServerConnection implements McpToolCaller, McpResourceServer {
+    readonly entry: McpServerEntry;
+    state: ServerState;
+    error: string | undefined;
+    tools: McpTool[];
+    /**
+     * Whether the server offers resources, which the resource tools list and read on demand. They are
+     * not listed at connect: listing every resource can take long (a large drive, say).
+     */
+    hasResources: boolean;
+    /** Server instructions from `initialize`, describing its tools as a group. */
+    instructions: string | undefined;
+    /** Last OAuth challenge from the server; sign-in uses its resource metadata URL and scope. */
+    challenge: OAuthChallenge | undefined;
+    private client;
+    private opening;
+    /** Aborted by `close()`; cancels a connect in progress, including the wait between retries. */
+    private readonly shutdown;
+    /** Stderr of the last stdio server that failed to connect. */
+    private stderrTail;
+    private readonly cwd;
+    private readonly createTransport;
+    private readonly authProvider;
+    private readonly onTools;
+    private readonly onChange;
+    private readonly log;
+    constructor(options: {
+        entry: McpServerEntry;
+        cwd: string;
+        createTransport: McpTransportFactory;
+        credentials: McpOAuthCredentialStore;
+        /** The current token of a pi provider, for servers with `auth.provider`. */
+        providerToken?: (provider: string) => Promise<string | undefined>;
+        onTools: (connection: McpServerConnection) => void;
+        /** Called when `state`, `error`, or `tools` change. */
+        onChange?: (connection: McpServerConnection) => void;
+        /** Receives the server's log messages (`notifications/message`). */
+        log?: McpServerLog;
+    });
+    get name(): string;
+    private get closed();
+    get timeoutMs(): number;
+    /** Server URL when the server authenticates with OAuth. */
+    get oauthUrl(): string | undefined;
+    oauthSettings(): McpOAuthSettings;
+    getClient(): Promise<McpClient>;
+    callTool(name: string, args: Record<string, unknown>, options: McpRequestOptions): Promise<CallToolResult>;
+    readResource(uri: string, options: McpRequestOptions): Promise<ReadResourceResult>;
+    resourcesPage(cursor: string | undefined, options: McpRequestOptions): Promise<ListResourcesResult>;
+    resourceTemplatesPage(cursor: string | undefined, options: McpRequestOptions): Promise<ListResourceTemplatesResult>;
+    allResources(options: McpRequestOptions): Promise<Resource[]>;
+    allResourceTemplates(options: McpRequestOptions): Promise<ResourceTemplate[]>;
+    /**
+     * Run a request, reconnecting when needed. `readOnly` requests are retried once after a transient
+     * HTTP error; tool calls are not, since they may have run.
+     */
+    private withClient;
+    /** Connect again with fresh credentials, for example after signing in. */
+    reconnect(): Promise<void>;
+    /** Disconnect after the stored credentials were removed. */
+    signOut(): Promise<void>;
+    /** OAuth servers that still reject the request after a refresh need the user to sign in again. */
+    private needsSignIn;
+    private markNeedsAuth;
+    private changed;
+    private dropClient;
+    private open;
+    private connectOnce;
+    private connectFailed;
+    /** The transport dropped. The next call reconnects; until then the status shows why. */
+    private handleClientClose;
+    private refreshTools;
+    /** Resolves once no transport of this server is open, including one that was still connecting. */
+    close(): Promise<void>;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/extensions/mcp/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/extensions/mcp/runtime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,KAAK,mBAAmB,EACxB,KAAK,2BAA2B,EAEhC,SAAS,EAGT,KAAK,iBAAiB,EAEtB,KAAK,IAAI,IAAI,OAAO,EACpB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EAGrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGN,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,MAAM,8BAA8B,CAAC;AAItC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAyB,KAAK,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAOtE;;;GAGG;AACH,KAAK,WAAW,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,GAAG,YAAY,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEpG,MAAM,MAAM,mBAAmB,GAAG,CACjC,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,YAAY,GAAG,SAAS,KAClC,YAAY,CAAC;AAmClB,wBAAgB,sBAAsB,CACrC,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,MAAM,EACX,YAAY,EAAE,YAAY,GAAG,SAAS,GACpC,YAAY,CAoBd;AAgBD,sFAAsF;AACtF,qBAAa,mBAAoB,YAAW,aAAa,EAAE,iBAAiB;IAC3E,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,KAAK,EAAE,WAAW,CAAgB;IAClC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,KAAK,EAAE,OAAO,EAAE,CAAM;IACtB;;;OAGG;IACH,YAAY,UAAS;IACrB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,8FAA8F;IAC9F,SAAS,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,OAAO,CAAiC;IAChD,+FAA+F;IAC/F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,8DAA8D;IAC9D,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAsB;IACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA8B;IAC3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4C;IACpE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0D;IACnF,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA2B;IAE/C,YAAY,OAAO,EAAE;QACpB,KAAK,EAAE,cAAc,CAAC;QACtB,GAAG,EAAE,MAAM,CAAC;QACZ,eAAe,EAAE,mBAAmB,CAAC;QACrC,WAAW,EAAE,uBAAuB,CAAC;QACrC,4EAA4E;QAC5E,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QAClE,OAAO,EAAE,CAAC,UAAU,EAAE,mBAAmB,KAAK,IAAI,CAAC;QACnD,uDAAuD;QACvD,QAAQ,CAAC,EAAE,CAAC,UAAU,EAAE,mBAAmB,KAAK,IAAI,CAAC;QACrD,oEAAoE;QACpE,GAAG,CAAC,EAAE,YAAY,CAAC;KACnB,EAsBA;IAED,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,2DAA2D;IAC3D,IAAI,QAAQ,IAAI,MAAM,GAAG,SAAS,CAEjC;IAED,aAAa,IAAI,gBAAgB,CAgBhC;IAED,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,CAO9B;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAEzG;IAED,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEjF;IAED,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAElG;IAED,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAMlH;IAED,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAE5D;IAED,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE5E;IAED;;;OAGG;YACW,UAAU;IAyBxB,0EAA0E;IACpE,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAI/B;IAED,4DAA4D;IACtD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAI7B;IAED,kGAAkG;IAClG,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,OAAO;YAID,UAAU;YAKV,IAAI;YAmBJ,WAAW;IAkDzB,OAAO,CAAC,aAAa;IAWrB,wFAAwF;IACxF,OAAO,CAAC,iBAAiB;YASX,YAAY;IAY1B,kGAAkG;IAC5F,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAU3B;CACD"}