@mesh-tech/mesh-cli 0.38.1 → 0.40.0

package/dist/bin/{mesh.registry-identity-JW4KO7N7.js → mesh.registry-identity-3AR27UGO.js}

@@ -15,13 +15,13 @@ import {
   registrySessionCandidates,
   registryTokenRoles,
   resolveRegistryIdentity
-} from "./mesh.chunk-BF2SH6XT.js";
-import "./mesh.chunk-LMYPTJ2F.js";
+} from "./mesh.chunk-HJGMOEUG.js";
+import "./mesh.chunk-7HTKSUWR.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import "./mesh.chunk-WFFDF346.js";
 import "./mesh.chunk-IQOBTL42.js";
-import "./mesh.chunk-KN4BZOYH.js";
+import "./mesh.chunk-6SSOVZOI.js";
 export {
   REGISTRY_ALIAS,
   REGISTRY_CREDENTIAL_KEY,

package/dist/bin/mesh.registry-identity-3AR27UGO.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": [],
+  "mappings": "",
+  "names": []
+}

package/dist/bin/mesh.review-command-LUVZQN2T.js

@@ -0,0 +1,238 @@
+import {
+  classifyMcpTools,
+  defaultServeDir,
+  generateMcpServeDir,
+  mcpAuthHeaders,
+  parseMcpToolSnapshot,
+  readMcpManifestFile
+} from "./mesh.chunk-TDCH4SFQ.js";
+import {
+  discoverStackExternalServices,
+  ensureAwsCredentialsForStack,
+  resolveExternalServiceScope
+} from "./mesh.chunk-YE2WIY3Y.js";
+import "./mesh.chunk-7HTKSUWR.js";
+import "./mesh.chunk-2QIVBQX5.js";
+import "./mesh.chunk-MCBMHWXP.js";
+import {
+  logInfo
+} from "./mesh.chunk-WFFDF346.js";
+import "./mesh.chunk-IQOBTL42.js";
+import "./mesh.chunk-6SSOVZOI.js";
+
+// packages/mesh-cli/src/commands/mcp/review-command.ts
+import { SSMClient } from "@aws-sdk/client-ssm";
+import { GetSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import confirm from "@inquirer/confirm";
+
+// packages/mesh-cli/src/commands/mcp/review.ts
+import * as fs from "node:fs";
+function canonical(tool) {
+  return JSON.stringify(tool, Object.keys(tool).sort());
+}
+function describeChange(before, after) {
+  const parts = [];
+  if (before.description !== after.description) parts.push("description");
+  if (JSON.stringify(before.inputSchema) !== JSON.stringify(after.inputSchema))
+    parts.push("input schema");
+  if (JSON.stringify(before.outputSchema) !== JSON.stringify(after.outputSchema))
+    parts.push("output schema");
+  if (JSON.stringify(before.annotations) !== JSON.stringify(after.annotations))
+    parts.push("annotations (read/write classification)");
+  return parts.length > 0 ? parts.join(", ") : "other fields";
+}
+function diffSnapshot(current, fetched, enabledOps = [], classification = {}) {
+  const before = new Map(current.map((t) => [t.name, t]));
+  const after = new Map(fetched.map((t) => [t.name, t]));
+  const classified = {
+    ...classifyMcpTools(current, classification),
+    ...classifyMcpTools(fetched, classification)
+  };
+  const accessOf = (name) => {
+    const entry = classified[name];
+    return { access: entry.access, ...entry.suggested ? { suggested: entry.suggested } : {} };
+  };
+  const entries = [];
+  for (const tool of fetched) {
+    const prior = before.get(tool.name);
+    if (!prior) {
+      entries.push({ name: tool.name, status: "added", ...accessOf(tool.name) });
+    } else if (canonical(prior) !== canonical(tool)) {
+      entries.push({
+        name: tool.name,
+        status: "changed",
+        ...accessOf(tool.name),
+        detail: describeChange(prior, tool)
+      });
+    } else {
+      entries.push({ name: tool.name, status: "unchanged", ...accessOf(tool.name) });
+    }
+  }
+  for (const tool of current) {
+    if (!after.has(tool.name)) {
+      entries.push({ name: tool.name, status: "removed", ...accessOf(tool.name) });
+    }
+  }
+  const pick = (status) => entries.filter((e) => e.status === status).map((e) => e.name);
+  const removed = pick("removed");
+  return {
+    entries,
+    added: pick("added"),
+    changed: pick("changed"),
+    removed,
+    removedEnabled: enabledOps.filter((op) => removed.includes(op)),
+    clean: pick("added").length === 0 && pick("changed").length === 0 && removed.length === 0,
+    next: [...fetched]
+  };
+}
+async function reviewMcpCatalog(opts) {
+  const loaded = readMcpManifestFile(opts.manifestPath);
+  const { manifest } = loaded;
+  const report = opts.report ?? ((line) => console.log(line));
+  const snapshotPath = loaded.toolsPath;
+  const headers = mcpAuthHeaders(manifest, opts.credentials);
+  const fetched = parseMcpToolSnapshot(
+    await opts.fetchTools({
+      serverUrl: manifest.serverUrl,
+      headers,
+      timeoutMs: manifest.timeoutMs ?? 3e4
+    }),
+    `${manifest.serverUrl} tools/list`
+  );
+  if (fetched.length === 0) {
+    throw new Error(
+      `${manifest.name}: the server answered tools/list with an empty catalog \u2014 refusing to replace a reviewed snapshot with nothing`
+    );
+  }
+  const enabled = manifest.enabledOps ?? loaded.tools.map((t) => t.name);
+  const diff = diffSnapshot(loaded.tools, fetched, enabled, manifest.classification ?? {});
+  report(`${manifest.name} \u2014 ${manifest.serverUrl}`);
+  report(`  snapshot: ${snapshotPath}`);
+  for (const entry of diff.entries) {
+    const mark = entry.status === "added" ? "+" : entry.status === "removed" ? "-" : entry.status === "changed" ? "~" : " ";
+    const enabledMark = enabled.includes(entry.name) ? "enabled" : "not enabled";
+    const suggestion = entry.suggested ? ", vendor suggests read" : "";
+    report(
+      `  ${mark} ${entry.name} [${entry.access}${suggestion}, ${enabledMark}]${entry.detail ? ` \u2014 ${entry.detail}` : ""}`
+    );
+  }
+  const suggestedReads = diff.entries.filter((entry) => entry.suggested === "read" && entry.status !== "removed").map((entry) => entry.name);
+  if (suggestedReads.length > 0) {
+    report(
+      `  the vendor marks ${suggestedReads.join(", ")} read-only (readOnlyHint). They stay unknown and need approval until the manifest's "classification" names them "read".`
+    );
+  }
+  if (diff.added.length > 0) {
+    report(
+      `  ${diff.added.length} new upstream tool(s) will be recorded but NOT enabled: add them to enabledOps deliberately.`
+    );
+  }
+  if (diff.removedEnabled.length > 0) {
+    throw new Error(
+      `${manifest.name}: the server no longer offers enabled operation(s) ${diff.removedEnabled.join(", ")} \u2014 remove them from enabledOps first, then re-review`
+    );
+  }
+  if (diff.clean) {
+    report("  no changes \u2014 the reviewed snapshot still matches the server.");
+    return { diff, manifest, snapshotPath, written: false };
+  }
+  if (opts.dryRun) {
+    report("  --dry-run: nothing written.");
+    return { diff, manifest, snapshotPath, written: false };
+  }
+  const approved = opts.yes === true || await (opts.confirm ?? (async () => false))(`Write the new snapshot to ${snapshotPath}?`);
+  if (!approved) {
+    report("  not written.");
+    return { diff, manifest, snapshotPath, written: false };
+  }
+  fs.writeFileSync(snapshotPath, `${JSON.stringify(diff.next, null, 2)}
+`);
+  report(`  wrote ${diff.next.length} reviewed tool(s).`);
+  const serveDir = defaultServeDir(opts.manifestPath, manifest.name);
+  if (fs.existsSync(serveDir)) {
+    const generated = generateMcpServeDir(opts.manifestPath);
+    report(`  regenerated ${generated.written.join(", ") || "nothing"} in ${generated.serveDir}.`);
+  } else {
+    report(`  run \`mesh mcp generate ${opts.manifestPath}\` to write the worker package.`);
+  }
+  return { diff, manifest, snapshotPath, written: true };
+}
+
+// packages/mesh-cli/src/commands/mcp/review-command.ts
+async function resolveIntegrationCredentials(name, opts, clients = {}) {
+  const region = opts.region ?? process.env.AWS_REGION ?? "us-east-2";
+  let secretId = opts.secret;
+  if (secretId) {
+    const ensure = clients.ensureCredentials ?? ensureAwsCredentialsForStack;
+    await ensure(resolveExternalServiceScope(opts).stack);
+  } else {
+    const { scope, services } = await discoverStackExternalServices(
+      opts,
+      clients.ssm ?? new SSMClient({ region }),
+      clients.ensureCredentials ? { ensureCredentials: clients.ensureCredentials } : {}
+    );
+    const service = services.get(name);
+    if (!service?.meta?.secretPrefix) {
+      throw new Error(
+        `No deployed ExternalService named "${name}" in ${scope.context.tenant}/${scope.platformEnv} (stack ${scope.stack ?? "unknown"}). Deploy the Integration first, or pass --secret <id>.`
+      );
+    }
+    secretId = service.meta.secretPrefix;
+  }
+  const response = await (clients.secretsManager ?? new SecretsManagerClient({ region })).send(
+    new GetSecretValueCommand({ SecretId: secretId })
+  );
+  if (!response.SecretString) {
+    throw new Error(
+      `The Integration credential at "${secretId}" is empty \u2014 populate it with \`mesh secrets set external/${name}\``
+    );
+  }
+  return JSON.parse(response.SecretString);
+}
+var fetchMcpToolsOverHttp = async ({ serverUrl, headers, timeoutMs }) => {
+  const { Client, StreamableHTTPClientTransport } = await import("@modelcontextprotocol/client");
+  const client = new Client(
+    { name: "mesh-mcp-review", version: "1.0.0" },
+    { capabilities: {}, versionNegotiation: { mode: "auto" } }
+  );
+  const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+    requestInit: { headers, redirect: "error" }
+  });
+  try {
+    await client.connect(transport, { timeout: timeoutMs });
+    const result = await client.listTools(void 0, { timeout: timeoutMs });
+    return result.tools;
+  } finally {
+    if (transport.sessionId) await transport.terminateSession().catch(() => {
+    });
+    await client.close().catch(() => {
+    });
+    await transport.close().catch(() => {
+    });
+  }
+};
+async function runMcpReviewCommand(manifestPath, opts) {
+  const { manifest } = readMcpManifestFile(manifestPath);
+  const credentials = manifest.auth.kind === "shared-header" ? await resolveIntegrationCredentials(manifest.name, opts) : {};
+  if (manifest.auth.kind === "none") {
+    logInfo(`${manifest.name} declares no authentication; connecting unauthenticated.`);
+  }
+  const result = await reviewMcpCatalog({
+    manifestPath,
+    credentials,
+    fetchTools: fetchMcpToolsOverHttp,
+    ...opts.yes ? { yes: true } : {},
+    ...opts.dryRun ? { dryRun: true } : {},
+    confirm: (question) => confirm({ message: question, default: false })
+  });
+  if (result.written) {
+    logInfo(
+      "Commit the snapshot with the regenerated worker package; McpIntegration refuses a package that does not match its manifest."
+    );
+  }
+}
+export {
+  fetchMcpToolsOverHttp,
+  resolveIntegrationCredentials,
+  runMcpReviewCommand
+};

package/dist/bin/mesh.review-command-LUVZQN2T.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/commands/mcp/review-command.ts", "../../src/commands/mcp/review.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;AAOA,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB,4BAA4B;AAC5D,OAAO,aAAa;;;ACapB,YAAY,QAAQ;AA0CpB,SAAS,UAAU,MAAuB;AACxC,SAAO,KAAK,UAAU,MAAM,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC;AACtD;AAEA,SAAS,eAAe,QAAiB,OAAwB;AAC/D,QAAM,QAAkB,CAAC;AACzB,MAAI,OAAO,gBAAgB,MAAM,YAAa,OAAM,KAAK,aAAa;AACtE,MAAI,KAAK,UAAU,OAAO,WAAW,MAAM,KAAK,UAAU,MAAM,WAAW;AACzE,UAAM,KAAK,cAAc;AAC3B,MAAI,KAAK,UAAU,OAAO,YAAY,MAAM,KAAK,UAAU,MAAM,YAAY;AAC3E,UAAM,KAAK,eAAe;AAC5B,MAAI,KAAK,UAAU,OAAO,WAAW,MAAM,KAAK,UAAU,MAAM,WAAW;AACzE,UAAM,KAAK,yCAAyC;AACtD,SAAO,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI;AAC/C;AAeO,SAAS,aACd,SACA,SACA,aAAgC,CAAC,GACjC,iBAAgD,CAAC,GACnC;AACd,QAAM,SAAS,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACtD,QAAM,QAAQ,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACrD,QAAM,aAAa;AAAA,IACjB,GAAG,iBAAiB,SAAS,cAAc;AAAA,IAC3C,GAAG,iBAAiB,SAAS,cAAc;AAAA,EAC7C;AACA,QAAM,WAAW,CAAC,SAA8D;AAC9E,UAAM,QAAQ,WAAW,IAAI;AAC7B,WAAO,EAAE,QAAQ,MAAM,QAAQ,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC,EAAG;AAAA,EAC5F;AACA,QAAM,UAA2B,CAAC;AAElC,aAAW,QAAQ,SAAS;AAC1B,UAAM,QAAQ,OAAO,IAAI,KAAK,IAAI;AAClC,QAAI,CAAC,OAAO;AACV,cAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,SAAS,GAAG,SAAS,KAAK,IAAI,EAAE,CAAC;AAAA,IAC3E,WAAW,UAAU,KAAK,MAAM,UAAU,IAAI,GAAG;AAC/C,cAAQ,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,GAAG,SAAS,KAAK,IAAI;AAAA,QACrB,QAAQ,eAAe,OAAO,IAAI;AAAA,MACpC,CAAC;AAAA,IACH,OAAO;AACL,cAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,aAAa,GAAG,SAAS,KAAK,IAAI,EAAE,CAAC;AAAA,IAC/E;AAAA,EACF;AACA,aAAW,QAAQ,SAAS;AAC1B,QAAI,CAAC,MAAM,IAAI,KAAK,IAAI,GAAG;AACzB,cAAQ,KAAK,EAAE,MAAM,KAAK,MAAM,QAAQ,WAAW,GAAG,SAAS,KAAK,IAAI,EAAE,CAAC;AAAA,IAC7E;AAAA,EACF;AAEA,QAAM,OAAO,CAAC,WACZ,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC9D,QAAM,UAAU,KAAK,SAAS;AAC9B,SAAO;AAAA,IACL;AAAA,IACA,OAAO,KAAK,OAAO;AAAA,IACnB,SAAS,KAAK,SAAS;AAAA,IACvB;AAAA,IACA,gBAAgB,WAAW,OAAO,CAAC,OAAO,QAAQ,SAAS,EAAE,CAAC;AAAA,IAC9D,OAAO,KAAK,OAAO,EAAE,WAAW,KAAK,KAAK,SAAS,EAAE,WAAW,KAAK,QAAQ,WAAW;AAAA,IACxF,MAAM,CAAC,GAAG,OAAO;AAAA,EACnB;AACF;AA6CA,eAAsB,iBACpB,MACiC;AACjC,QAAM,SAAS,oBAAoB,KAAK,YAAY;AACpD,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,SAAS,KAAK,WAAW,CAAC,SAAiB,QAAQ,IAAI,IAAI;AACjE,QAAM,eAAe,OAAO;AAK5B,QAAM,UAAU,eAAe,UAAU,KAAK,WAAW;AAEzD,QAAM,UAAU;AAAA,IACd,MAAM,KAAK,WAAW;AAAA,MACpB,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,WAAW,SAAS,aAAa;AAAA,IACnC,CAAC;AAAA,IACD,GAAG,SAAS,SAAS;AAAA,EACvB;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI;AAAA,MACR,GAAG,SAAS,IAAI;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,UAAU,SAAS,cAAc,OAAO,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AACrE,QAAM,OAAO,aAAa,OAAO,OAAO,SAAS,SAAS,SAAS,kBAAkB,CAAC,CAAC;AAEvF,SAAO,GAAG,SAAS,IAAI,WAAM,SAAS,SAAS,EAAE;AACjD,SAAO,eAAe,YAAY,EAAE;AACpC,aAAW,SAAS,KAAK,SAAS;AAChC,UAAM,OACJ,MAAM,WAAW,UACb,MACA,MAAM,WAAW,YACf,MACA,MAAM,WAAW,YACf,MACA;AACV,UAAM,cAAc,QAAQ,SAAS,MAAM,IAAI,IAAI,YAAY;AAC/D,UAAM,aAAa,MAAM,YAAY,2BAA2B;AAChE;AAAA,MACE,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,MAAM,MAAM,GAAG,UAAU,KAAK,WAAW,IAAI,MAAM,SAAS,WAAM,MAAM,MAAM,KAAK,EAAE;AAAA,IACnH;AAAA,EACF;AACA,QAAM,iBAAiB,KAAK,QACzB,OAAO,CAAC,UAAU,MAAM,cAAc,UAAU,MAAM,WAAW,SAAS,EAC1E,IAAI,CAAC,UAAU,MAAM,IAAI;AAC5B,MAAI,eAAe,SAAS,GAAG;AAC7B;AAAA,MACE,sBAAsB,eAAe,KAAK,IAAI,CAAC;AAAA,IACjD;AAAA,EACF;AACA,MAAI,KAAK,MAAM,SAAS,GAAG;AACzB;AAAA,MACE,KAAK,KAAK,MAAM,MAAM;AAAA,IACxB;AAAA,EACF;AAEA,MAAI,KAAK,eAAe,SAAS,GAAG;AAIlC,UAAM,IAAI;AAAA,MACR,GAAG,SAAS,IAAI,sDAAsD,KAAK,eAAe,KAAK,IAAI,CAAC;AAAA,IACtG;AAAA,EACF;AAEA,MAAI,KAAK,OAAO;AACd,WAAO,qEAAgE;AACvE,WAAO,EAAE,MAAM,UAAU,cAAc,SAAS,MAAM;AAAA,EACxD;AACA,MAAI,KAAK,QAAQ;AACf,WAAO,+BAA+B;AACtC,WAAO,EAAE,MAAM,UAAU,cAAc,SAAS,MAAM;AAAA,EACxD;AAEA,QAAM,WACJ,KAAK,QAAQ,QACZ,OAAO,KAAK,YAAY,YAAY,QAAQ,6BAA6B,YAAY,GAAG;AAC3F,MAAI,CAAC,UAAU;AACb,WAAO,gBAAgB;AACvB,WAAO,EAAE,MAAM,UAAU,cAAc,SAAS,MAAM;AAAA,EACxD;AACA,EAAG,iBAAc,cAAc,GAAG,KAAK,UAAU,KAAK,MAAM,MAAM,CAAC,CAAC;AAAA,CAAI;AACxE,SAAO,WAAW,KAAK,KAAK,MAAM,oBAAoB;AAItD,QAAM,WAAW,gBAAgB,KAAK,cAAc,SAAS,IAAI;AACjE,MAAO,cAAW,QAAQ,GAAG;AAC3B,UAAM,YAAY,oBAAoB,KAAK,YAAY;AACvD,WAAO,iBAAiB,UAAU,QAAQ,KAAK,IAAI,KAAK,SAAS,OAAO,UAAU,QAAQ,GAAG;AAAA,EAC/F,OAAO;AACL,WAAO,6BAA6B,KAAK,YAAY,iCAAiC;AAAA,EACxF;AACA,SAAO,EAAE,MAAM,UAAU,cAAc,SAAS,KAAK;AACvD;;;ADhQA,eAAsB,8BACpB,MACA,MACA,UAII,CAAC,GAC4B;AACjC,QAAM,SAAS,KAAK,UAAU,QAAQ,IAAI,cAAc;AAExD,MAAI,WAAW,KAAK;AACpB,MAAI,UAAU;AACZ,UAAM,SAAS,QAAQ,qBAAqB;AAC5C,UAAM,OAAO,4BAA4B,IAAI,EAAE,KAAK;AAAA,EACtD,OAAO;AACL,UAAM,EAAE,OAAO,SAAS,IAAI,MAAM;AAAA,MAChC;AAAA,MACA,QAAQ,OAAO,IAAI,UAAU,EAAE,OAAO,CAAC;AAAA,MACvC,QAAQ,oBAAoB,EAAE,mBAAmB,QAAQ,kBAAkB,IAAI,CAAC;AAAA,IAClF;AACA,UAAM,UAAU,SAAS,IAAI,IAAI;AACjC,QAAI,CAAC,SAAS,MAAM,cAAc;AAChC,YAAM,IAAI;AAAA,QACR,sCAAsC,IAAI,QAAQ,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,WAAW,MAAM,SAAS,SAAS;AAAA,MAChI;AAAA,IACF;AACA,eAAW,QAAQ,KAAK;AAAA,EAC1B;AAEA,QAAM,WAAW,OAAO,QAAQ,kBAAkB,IAAI,qBAAqB,EAAE,OAAO,CAAC,GAAG;AAAA,IACtF,IAAI,sBAAsB,EAAE,UAAU,SAAS,CAAC;AAAA,EAClD;AACA,MAAI,CAAC,SAAS,cAAc;AAC1B,UAAM,IAAI;AAAA,MACR,kCAAkC,QAAQ,kEAA6D,IAAI;AAAA,IAC7G;AAAA,EACF;AACA,SAAO,KAAK,MAAM,SAAS,YAAY;AACzC;AAMO,IAAM,wBAAuC,OAAO,EAAE,WAAW,SAAS,UAAU,MAAM;AAC/F,QAAM,EAAE,QAAQ,8BAA8B,IAAI,MAAM,OAAO,8BAA8B;AAC7F,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,mBAAmB,SAAS,QAAQ;AAAA,IAC5C,EAAE,cAAc,CAAC,GAAG,oBAAoB,EAAE,MAAM,OAAO,EAAE;AAAA,EAC3D;AACA,QAAM,YAAY,IAAI,8BAA8B,IAAI,IAAI,SAAS,GAAG;AAAA,IACtE,aAAa,EAAE,SAAS,UAAU,QAAQ;AAAA,EAC5C,CAAC;AACD,MAAI;AACF,UAAM,OAAO,QAAQ,WAAW,EAAE,SAAS,UAAU,CAAC;AACtD,UAAM,SAAS,MAAM,OAAO,UAAU,QAAW,EAAE,SAAS,UAAU,CAAC;AACvE,WAAO,OAAO;AAAA,EAChB,UAAE;AACA,QAAI,UAAU,UAAW,OAAM,UAAU,iBAAiB,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAC1E,UAAM,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACnC,UAAM,UAAU,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EACxC;AACF;AAGA,eAAsB,oBACpB,cACA,MASe;AACf,QAAM,EAAE,SAAS,IAAI,oBAAoB,YAAY;AAErD,QAAM,cACJ,SAAS,KAAK,SAAS,kBACnB,MAAM,8BAA8B,SAAS,MAAM,IAAI,IACvD,CAAC;AACP,MAAI,SAAS,KAAK,SAAS,QAAQ;AACjC,YAAQ,GAAG,SAAS,IAAI,0DAA0D;AAAA,EACpF;AAEA,QAAM,SAAS,MAAM,iBAAiB;AAAA,IACpC;AAAA,IACA;AAAA,IACA,YAAY;AAAA,IACZ,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,IAChC,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC;AAAA,IACtC,SAAS,CAAC,aAAa,QAAQ,EAAE,SAAS,UAAU,SAAS,MAAM,CAAC;AAAA,EACtE,CAAC;AAED,MAAI,OAAO,SAAS;AAClB;AAAA,MACE;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/bin/{mesh.start-MPQFIEMH.js → mesh.start-KZ5L6SOJ.js}

@@ -4,7 +4,7 @@ import {
   reportAssembly,
   resolveCliRuntime,
   runAssemble
-} from "./mesh.chunk-HPYZWPRM.js";
+} from "./mesh.chunk-PZVI7V3J.js";
 import {
   logError,
   logInfo,
@@ -13,7 +13,7 @@ import {
 import {
   homeNpmrcPath,
   parseNpmrcRegistryAuth
-} from "./mesh.chunk-KN4BZOYH.js";
+} from "./mesh.chunk-6SSOVZOI.js";
 
 // packages/mesh-cli/src/docs/start.ts
 import { execFileSync as execFileSync2 } from "node:child_process";

package/dist/bin/{mesh.wizard-ZJE4S6PC.js → mesh.wizard-FCTT55KI.js}

@@ -2,24 +2,24 @@ import {
   bootstrapAppsRepo,
   isInsidePlatformMonorepo,
   shouldBootstrapAppsRepo
-} from "./mesh.chunk-2YRWJH5X.js";
+} from "./mesh.chunk-F44A3ACW.js";
 import {
   PLATFORM_SETUP_DEFAULTS,
   ensureStateBucket,
   renderPlatformNextSteps,
   resolvePlatformSetup,
   scaffoldPlatformRepo
-} from "./mesh.chunk-TZAGJTKU.js";
+} from "./mesh.chunk-NSQJEX36.js";
 import {
   RegistryNotAuthorizedError
-} from "./mesh.chunk-IU2IWH6O.js";
+} from "./mesh.chunk-6AIG5OJM.js";
 import {
   resolveTargetRoot,
   syncSkills
 } from "./mesh.chunk-F4654EPX.js";
 import {
   readRegistrySession
-} from "./mesh.chunk-BF2SH6XT.js";
+} from "./mesh.chunk-HJGMOEUG.js";
 import {
   detectLocalTenant,
   discoverConfigForContext,
@@ -31,7 +31,7 @@ import {
   runLoginFlow,
   tokenStillValid,
   writeMeshJson
-} from "./mesh.chunk-LMYPTJ2F.js";
+} from "./mesh.chunk-7HTKSUWR.js";
 import "./mesh.chunk-2QIVBQX5.js";
 import "./mesh.chunk-MCBMHWXP.js";
 import {
@@ -44,7 +44,7 @@ import {
 } from "./mesh.chunk-IQOBTL42.js";
 import {
   probeRegistryToken
-} from "./mesh.chunk-KN4BZOYH.js";
+} from "./mesh.chunk-6SSOVZOI.js";
 
 // packages/mesh-cli/src/commands/init/wizard.ts
 import * as fs from "fs";
@@ -157,7 +157,7 @@ var registryStep = {
     try {
       logInfo(REGISTRY_WHY);
       const login = ctx.seams?.runRegistryLogin ?? (async (opts) => {
-        const { runRegistryLogin } = await import("./mesh.registry-7P4MGXEK.js");
+        const { runRegistryLogin } = await import("./mesh.registry-JLQYFUNN.js");
         await runRegistryLogin(void 0, opts);
       });
       await login({ device: ctx.device, profile: ctx.profile });

package/dist/bin/mesh.workspace-membership-DI3YQGEK.js

@@ -0,0 +1,65 @@
+// packages/mesh-cli/src/commands/mcp/workspace-membership.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse } from "yaml";
+function findWorkspaceFile(from) {
+  let dir = from;
+  for (; ; ) {
+    const file = path.join(dir, "pnpm-workspace.yaml");
+    if (fs.existsSync(file)) return file;
+    const parent = path.dirname(dir);
+    if (parent === dir) return void 0;
+    dir = parent;
+  }
+}
+function segmentPattern(segment) {
+  const body = segment.split("").map(
+    (ch) => ch === "*" ? "[^/]*" : ch === "?" ? "[^/]" : ch.replace(/[.+^${}()|[\]\\]/g, "\\$&")
+  ).join("");
+  return new RegExp(segment.startsWith(".") ? `^${body}$` : `^(?!\\.)${body}$`);
+}
+function matchSegments(pattern, target) {
+  if (pattern.length === 0) return target.length === 0;
+  const [head, ...rest] = pattern;
+  if (head === "**") {
+    for (let i = 0; i <= target.length; i++) {
+      if (target.slice(0, i).some((s) => s.startsWith("."))) break;
+      if (matchSegments(rest, target.slice(i))) return true;
+    }
+    return false;
+  }
+  if (target.length === 0) return false;
+  return segmentPattern(head).test(target[0]) && matchSegments(rest, target.slice(1));
+}
+function matchesWorkspaceGlob(pattern, relDir) {
+  const clean = (p) => p.replace(/^\.\//, "").replace(/\/+$/, "").split("/").filter((s) => s.length > 0 && s !== ".");
+  return matchSegments(clean(pattern), clean(relDir.split(path.sep).join("/")));
+}
+function workspaceMembership(dir) {
+  const abs = path.resolve(dir);
+  const workspaceFile = findWorkspaceFile(abs);
+  if (!workspaceFile) return { member: false };
+  const root = path.dirname(workspaceFile);
+  const rel = path.relative(root, abs).split(path.sep).join("/");
+  const suggestedGlob = `${path.posix.dirname(rel)}/*`;
+  let globs;
+  try {
+    globs = parse(fs.readFileSync(workspaceFile, "utf8"))?.packages;
+  } catch {
+    return { workspaceFile, member: false, suggestedGlob };
+  }
+  let member = false;
+  for (const glob of Array.isArray(globs) ? globs : []) {
+    if (typeof glob !== "string") continue;
+    if (glob.startsWith("!")) {
+      if (matchesWorkspaceGlob(glob.slice(1), rel)) member = false;
+    } else if (matchesWorkspaceGlob(glob, rel)) {
+      member = true;
+    }
+  }
+  return { workspaceFile, member, suggestedGlob };
+}
+export {
+  matchesWorkspaceGlob,
+  workspaceMembership
+};

package/dist/bin/mesh.workspace-membership-DI3YQGEK.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/commands/mcp/workspace-membership.ts"],
+  "mappings": ";AASA,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,SAAS,aAAa;AAetB,SAAS,kBAAkB,MAAkC;AAC3D,MAAI,MAAM;AACV,aAAS;AACP,UAAM,OAAY,UAAK,KAAK,qBAAqB;AACjD,QAAO,cAAW,IAAI,EAAG,QAAO;AAChC,UAAM,SAAc,aAAQ,GAAG;AAC/B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAEA,SAAS,eAAe,SAAyB;AAC/C,QAAM,OAAO,QACV,MAAM,EAAE,EACR;AAAA,IAAI,CAAC,OACJ,OAAO,MAAM,UAAU,OAAO,MAAM,SAAS,GAAG,QAAQ,qBAAqB,MAAM;AAAA,EACrF,EACC,KAAK,EAAE;AAGV,SAAO,IAAI,OAAO,QAAQ,WAAW,GAAG,IAAI,IAAI,IAAI,MAAM,WAAW,IAAI,GAAG;AAC9E;AAEA,SAAS,cAAc,SAAmB,QAA2B;AACnE,MAAI,QAAQ,WAAW,EAAG,QAAO,OAAO,WAAW;AACnD,QAAM,CAAC,MAAM,GAAG,IAAI,IAAI;AACxB,MAAI,SAAS,MAAM;AACjB,aAAS,IAAI,GAAG,KAAK,OAAO,QAAQ,KAAK;AACvC,UAAI,OAAO,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,CAAC,EAAG;AACvD,UAAI,cAAc,MAAM,OAAO,MAAM,CAAC,CAAC,EAAG,QAAO;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,SAAO,eAAe,IAAK,EAAE,KAAK,OAAO,CAAC,CAAE,KAAK,cAAc,MAAM,OAAO,MAAM,CAAC,CAAC;AACtF;AAWO,SAAS,qBAAqB,SAAiB,QAAyB;AAC7E,QAAM,QAAQ,CAAC,MACb,EACG,QAAQ,SAAS,EAAE,EACnB,QAAQ,QAAQ,EAAE,EAClB,MAAM,GAAG,EACT,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,GAAG;AAC5C,SAAO,cAAc,MAAM,OAAO,GAAG,MAAM,OAAO,MAAW,QAAG,EAAE,KAAK,GAAG,CAAC,CAAC;AAC9E;AAWO,SAAS,oBAAoB,KAAkC;AACpE,QAAM,MAAW,aAAQ,GAAG;AAC5B,QAAM,gBAAgB,kBAAkB,GAAG;AAC3C,MAAI,CAAC,cAAe,QAAO,EAAE,QAAQ,MAAM;AAC3C,QAAM,OAAY,aAAQ,aAAa;AACvC,QAAM,MAAW,cAAS,MAAM,GAAG,EAAE,MAAW,QAAG,EAAE,KAAK,GAAG;AAC7D,QAAM,gBAAgB,GAAQ,WAAM,QAAQ,GAAG,CAAC;AAChD,MAAI;AACJ,MAAI;AACF,YAAS,MAAS,gBAAa,eAAe,MAAM,CAAC,GACjD;AAAA,EACN,QAAQ;AACN,WAAO,EAAE,eAAe,QAAQ,OAAO,cAAc;AAAA,EACvD;AACA,MAAI,SAAS;AACb,aAAW,QAAQ,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAAG;AACpD,QAAI,OAAO,SAAS,SAAU;AAC9B,QAAI,KAAK,WAAW,GAAG,GAAG;AACxB,UAAI,qBAAqB,KAAK,MAAM,CAAC,GAAG,GAAG,EAAG,UAAS;AAAA,IACzD,WAAW,qBAAqB,MAAM,GAAG,GAAG;AAC1C,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO,EAAE,eAAe,QAAQ,cAAc;AAChD;",
+  "names": []
+}

package/dist/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "ac9c6b19f",
-  "builtAt": "2026-09-30T21:30:19.767Z"
+  "commit": "e76bb0770",
+  "builtAt": "2026-10-16T01:18:50.130Z"
 }

package/dist/src/commands/app-check.js

@@ -75,7 +75,7 @@ export const APP_CHECK_RULES = {
         gate: "H",
         title: "No role grants in IaC",
         severity: "block",
-        remediation: "remove the per-user grant map; grant roles from the Hub (App → Access → Users)",
+        remediation: "remove the per-user grant map; grant roles from the Hub (App → Access → Sign-in)",
         scope: "app",
     },
     POINTER_PROJECT_OVERRIDE: {
@@ -794,7 +794,7 @@ export function scanApp(root, appRel, resolution = probeResolution(root, appRel)
         for (const f of files)
             hit(code, rel(root, f), why);
     };
-    anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC — grants belong in the Hub (Access → Users), not in a config redeploy");
+    anti("IAC_GRANTS", RE_IAC_GRANT, "per-user role grant baked into IaC — grants belong in the Hub (Access → Sign-in), not in a config redeploy");
     anti("POINTER_PROJECT_OVERRIDE", RE_POINTER_OVERRIDE, "AppAuthzPointer is given a `zitadel:` override — an app binds its project with AppEnvironment's zitadelAppProjectId so every consumer of env.zitadel agrees; the override is reserved for the Hub");
     anti("PASSWORD_STORE", RE_PASSWORD, "password storage or hashing — Zitadel owns credentials; the Hub creates sign-in users with a one-time temporary password");
     anti("EMAIL_ALLOWLIST", RE_ALLOWLIST, "email allowlist standing in for roles — declare a role and let the Hub grant it");

package/dist/src/commands/dev-doctor.d.ts

@@ -57,6 +57,28 @@ export declare function sharesWorktreeRoot(serviceSrc: string, repoRoot: string)
 export type PortOwnership = "owned" | "foreign" | "dead";
 export declare function classifyPortListener(listenerPid: number | null, sessionPids: ReadonlySet<number>): PortOwnership;
 export declare function collectSessionPids(panePids: number[], psOut: string): Set<number>;
+export type PaneLiveness = {
+    state: "running";
+} | {
+    state: "exited";
+    exitCode: number | null;
+    lastActivityEpoch: number | null;
+} | {
+    state: "unknown";
+    reason: string;
+};
+export type PaneProcessQuery = (command: string, args: string[]) => string;
+export declare function paneProcessQuery(command: string, args: string[]): string;
+export declare function listSessionWindowNames(sessionName: string, query: PaneProcessQuery): Set<string> | null;
+export declare function classifyPaneLiveness(target: string, query: PaneProcessQuery): PaneLiveness;
+export declare function classifySessionServices(sessionName: string, services: Record<string, {
+    command: string[];
+}>, query: PaneProcessQuery): Map<string, PaneLiveness>;
+export declare function describePaneExit(liveness: Extract<PaneLiveness, {
+    state: "exited";
+}>): string;
+export declare function servicesLivenessToResult(liveness: ReadonlyMap<string, PaneLiveness>): CheckResult;
+export declare const servicesCheck: Check;
 export declare const tmuxCheck: Check;
 export declare const portsCheck: Check;
 export declare function isConfigStale(configMtimeMs: number, startedAtIso: string): boolean;

package/dist/src/commands/dev-doctor.js

@@ -5,6 +5,7 @@ import * as path from "node:path";
 import { isLinkedDependencyDir, isPortFree } from "./dev.js";
 import { appUsesMeshPackages, probeRegistryToken, registryLoginFix, } from "../utils/auth-preflight.js";
 import { probeCredentials, isRemoteEnvironment } from "./login.js";
+import { envLeaksCheck } from "./dev-env-leaks.js";
 export function aggregateStatus(results) {
     if (results.some((r) => r.status === "error"))
         return "error";
@@ -262,6 +263,152 @@ function sessionProcessTree(sessionName) {
     }
     return collectSessionPids(panePids, psOut);
 }
+export function paneProcessQuery(command, args) {
+    return execFileSync(command, args, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+    });
+}
+export function listSessionWindowNames(sessionName, query) {
+    try {
+        const raw = query("tmux", ["list-windows", "-t", sessionName, "-F", "#{window_name}"]);
+        return new Set(raw
+            .trim()
+            .split("\n")
+            .map((line) => line.trim())
+            .filter(Boolean));
+    }
+    catch {
+        return null;
+    }
+}
+function parseOptionalNumber(field) {
+    if (field === undefined || field === "")
+        return null;
+    const n = Number(field);
+    return Number.isFinite(n) ? n : null;
+}
+export function classifyPaneLiveness(target, query) {
+    let raw;
+    try {
+        raw = query("tmux", [
+            "display",
+            "-p",
+            "-t",
+            target,
+            "#{pane_dead}|#{pane_dead_status}|#{pane_pid}|#{window_activity}",
+        ]);
+    }
+    catch {
+        return { state: "unknown", reason: `tmux could not report the pane at '${target}'` };
+    }
+    const [dead, deadStatus, pidStr, activityStr] = raw.trim().split("|");
+    const lastActivityEpoch = parseOptionalNumber(activityStr);
+    if (dead === "1") {
+        return { state: "exited", exitCode: parseOptionalNumber(deadStatus), lastActivityEpoch };
+    }
+    const pid = Number(pidStr);
+    if (!Number.isInteger(pid) || pid <= 0) {
+        return { state: "unknown", reason: `tmux reported no pane pid for '${target}'` };
+    }
+    let psOut;
+    try {
+        psOut = query("ps", ["-eo", "pid=,ppid="]);
+    }
+    catch {
+        return paneChildrenViaPgrep(pid, lastActivityEpoch, query);
+    }
+    return collectSessionPids([pid], psOut).size > 1
+        ? { state: "running" }
+        : { state: "exited", exitCode: null, lastActivityEpoch };
+}
+function paneChildrenViaPgrep(pid, lastActivityEpoch, query) {
+    try {
+        return query("pgrep", ["-P", String(pid)]).trim().length > 0
+            ? { state: "running" }
+            : { state: "exited", exitCode: null, lastActivityEpoch };
+    }
+    catch (err) {
+        if (err.status === 1) {
+            return { state: "exited", exitCode: null, lastActivityEpoch };
+        }
+        return { state: "unknown", reason: "could not read the process table (ps, pgrep)" };
+    }
+}
+export function classifySessionServices(sessionName, services, query) {
+    const windows = listSessionWindowNames(sessionName, query);
+    const result = new Map();
+    for (const [name, svc] of Object.entries(services)) {
+        if (!svc.command || svc.command.length === 0)
+            continue;
+        if (windows === null) {
+            result.set(name, {
+                state: "unknown",
+                reason: `could not list the windows of session '${sessionName}' (tmux)`,
+            });
+            continue;
+        }
+        if (!windows.has(name)) {
+            result.set(name, { state: "exited", exitCode: null, lastActivityEpoch: null });
+            continue;
+        }
+        result.set(name, classifyPaneLiveness(`${sessionName}:${name}`, query));
+    }
+    return result;
+}
+export function describePaneExit(liveness) {
+    if (liveness.exitCode !== null)
+        return `exit ${liveness.exitCode}`;
+    if (liveness.lastActivityEpoch !== null) {
+        return `no live process (last output ${new Date(liveness.lastActivityEpoch * 1000).toISOString()})`;
+    }
+    return "no live process";
+}
+export function servicesLivenessToResult(liveness) {
+    const total = liveness.size;
+    const dead = [];
+    const unknown = [];
+    for (const [name, l] of liveness.entries()) {
+        if (l.state === "exited")
+            dead.push([name, l]);
+        else if (l.state === "unknown")
+            unknown.push([name, l]);
+    }
+    if (dead.length === 0 && unknown.length === 0) {
+        return { status: "ok", summary: `all ${total} service process(es) running` };
+    }
+    if (dead.length > 0) {
+        return {
+            status: "error",
+            summary: `${dead.length} of ${total} service process(es) not running`,
+            detail: dead.map(([name, l]) => `${name} — ${describePaneExit(l)}`).join("; "),
+            remediation: dead.length === 1
+                ? `mesh dev logs ${dead[0][0]}`
+                : "mesh dev logs <svc> for each service above, then mesh dev restart <svc>",
+        };
+    }
+    return {
+        status: "warn",
+        summary: `could not determine liveness for ${unknown.length} of ${total} service(s)`,
+        detail: unknown.map(([name, l]) => `${name} — ${l.reason}`).join("; "),
+    };
+}
+export const servicesCheck = {
+    id: "services",
+    title: "Service processes",
+    phases: ["ondemand"],
+    async run(ctx) {
+        const services = ctx.sessionState?.devOutput.services;
+        if (!services || Object.keys(services).length === 0) {
+            return { status: "ok", summary: "no session — services start at launch" };
+        }
+        const liveness = classifySessionServices(ctx.sessionName, services, paneProcessQuery);
+        if (liveness.size === 0) {
+            return { status: "ok", summary: "no locally-run services in this session" };
+        }
+        return servicesLivenessToResult(liveness);
+    },
+};
 export const tmuxCheck = {
     id: "tmux",
     title: "tmux",
@@ -533,9 +680,11 @@ export const ALL_CHECKS = [
     registryCheck,
     configStalenessCheck,
     portsCheck,
+    servicesCheck,
     worktreeCheck,
     tunnelsCheck,
     temporalCheck,
+    envLeaksCheck,
 ];
 export async function runDoctor(ctx, opts) {
     const results = await runChecks(ctx, "ondemand", ALL_CHECKS);