@minionry/minion 0.7.36

package/dist/server/handlers/company-triggers.js

@@ -0,0 +1,189 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { randomUUID } from 'node:crypto';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolvePmDir } from '../services/plan/parser.js';
+import { loadTemplate } from '../services/plan/template-instantiator.js';
+import { computeRetryDelayMs, evaluateTriggers, getDownstreamTriggers, } from '../services/plan/trigger-evaluator.js';
+import { companyMessages, } from '../types/company-messages.js';
+export async function fireDownstreamTriggers(ctx, state, status, executeBoard) {
+    let template;
+    try {
+        template = loadBoardTemplate(state.workingDir, state.boardId);
+    }
+    catch (err) {
+        console.error(`[IS-027] Failed to load template for trigger evaluation (board=${state.boardId}):`, err);
+        return;
+    }
+    const triggers = getDownstreamTriggers(template);
+    if (triggers.length === 0)
+        return;
+    const artifacts = collectArtifacts(state.workingDir, state.boardId);
+    const evalResult = evaluateTriggers(triggers, {
+        upstreamBoardId: state.boardId,
+        upstreamStatus: toUpstreamStatus(status),
+        artifacts,
+        chain: state.triggerChain,
+    });
+    for (const diagnostic of evalResult.diagnostics) {
+        console.warn(`[IS-027] ${diagnostic}`);
+    }
+    for (const decision of evalResult.decisions) {
+        if (!decision.shouldFire) {
+            broadcastTrigger(ctx, state, decision, 'skipped', {
+                reason: decision.skipReason ?? 'condition_not_met',
+            });
+            continue;
+        }
+        void fireSingleTrigger(ctx, state, decision, executeBoard);
+    }
+}
+async function fireSingleTrigger(ctx, state, decision, executeBoard) {
+    let lastError = '';
+    for (let attempt = 1; attempt <= decision.retry.maxAttempts; attempt++) {
+        const downstreamExecutionId = `trg-${state.executionId}-${decision.triggerId}-${attempt}-${randomUUID().slice(0, 8)}`;
+        const payload = {
+            companyId: state.companyId,
+            departmentId: state.departmentId,
+            departmentBoardId: decision.targetBoardId,
+            executionId: downstreamExecutionId,
+            trigger: 'board_trigger',
+            budgetRemainingCents: 0,
+            riskTolerance: state.riskTolerance,
+            upstreamContext: {
+                triggerId: decision.triggerId,
+                upstreamBoardId: state.boardId,
+                upstreamExecutionId: state.executionId,
+                chain: state.triggerChain,
+            },
+        };
+        let ok = false;
+        try {
+            ok = executeBoard(payload, state.workingDir);
+        }
+        catch (err) {
+            lastError = err instanceof Error ? err.message : String(err);
+            ok = false;
+        }
+        if (ok) {
+            broadcastTrigger(ctx, state, decision, 'fired', {
+                downstreamExecutionId,
+                attempt,
+            });
+            return;
+        }
+        if (!lastError) {
+            lastError = 'handleExecuteBoard returned false (see executionError broadcast for detail)';
+        }
+        if (attempt < decision.retry.maxAttempts) {
+            const delayMs = computeRetryDelayMs(decision.retry, attempt - 1);
+            await sleep(delayMs);
+        }
+    }
+    broadcastTrigger(ctx, state, decision, 'failed', {
+        reason: `Exhausted ${decision.retry.maxAttempts} attempts: ${lastError}`,
+        attempt: decision.retry.maxAttempts,
+    });
+}
+function broadcastTrigger(ctx, state, decision, status, extras) {
+    ctx.broadcastToAll(companyMessages.boardTriggered({
+        executionId: state.executionId,
+        triggerId: decision.triggerId,
+        upstreamBoardId: state.boardId,
+        downstreamBoardId: decision.targetBoardId,
+        downstreamExecutionId: extras.downstreamExecutionId,
+        status,
+        reason: extras.reason,
+        chain: decision.propagatedChain,
+        attempt: extras.attempt,
+        firedAt: new Date().toISOString(),
+        companyId: state.companyId,
+        departmentId: state.departmentId,
+    }));
+}
+function toUpstreamStatus(status) {
+    switch (status) {
+        case 'completed':
+            return 'completed';
+        case 'partial':
+            return 'partial';
+        case 'failed':
+            return 'failed';
+        case 'cancelled':
+            return 'cancelled';
+    }
+}
+function loadBoardTemplate(workingDir, boardId) {
+    const pmDir = resolvePmDir(workingDir);
+    if (!pmDir)
+        return null;
+    const templatesDir = join(pmDir, 'templates');
+    if (!existsSync(templatesDir))
+        return null;
+    const direct = join(templatesDir, `${boardId}.json`);
+    if (existsSync(direct)) {
+        try {
+            return loadTemplate(direct);
+        }
+        catch (err) {
+            console.warn(`[IS-027] Could not parse template ${direct}:`, err);
+            return null;
+        }
+    }
+    try {
+        for (const entry of readdirSync(templatesDir)) {
+            if (!entry.endsWith('.json'))
+                continue;
+            try {
+                const t = loadTemplate(join(templatesDir, entry));
+                if (t.template_id === boardId)
+                    return t;
+            }
+            catch {
+            }
+        }
+    }
+    catch {
+    }
+    return null;
+}
+function collectArtifacts(workingDir, boardId) {
+    const pmDir = resolvePmDir(workingDir);
+    if (!pmDir)
+        return [];
+    const outDir = join(pmDir, 'boards', boardId, 'out');
+    if (!existsSync(outDir))
+        return [];
+    const artifacts = [];
+    const MAX_BYTES = 256 * 1024;
+    let entries;
+    try {
+        entries = readdirSync(outDir);
+    }
+    catch {
+        return [];
+    }
+    for (const entry of entries) {
+        if (!entry.endsWith('.md'))
+            continue;
+        const fullPath = join(outDir, entry);
+        try {
+            const stat = statSync(fullPath);
+            if (!stat.isFile())
+                continue;
+            const raw = readFileSync(fullPath, 'utf-8');
+            artifacts.push({
+                fileName: entry,
+                path: fullPath,
+                content: raw.length > MAX_BYTES ? raw.slice(0, MAX_BYTES) : raw,
+            });
+        }
+        catch {
+        }
+    }
+    return artifacts;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
+}

package/dist/server/handlers/company-types.js

@@ -0,0 +1,3 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+export {};

package/dist/server/index.js

@@ -0,0 +1,244 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, join } from 'node:path';
+import { Hono } from 'hono';
+import { cors } from 'hono/cors';
+import { logger } from 'hono/logger';
+import { WebSocketServer } from 'ws';
+import { createFileRoutes, createImproviseRoutes, createInstanceRoutes, createInternalRoutes, createNotificationRoutes, createShutdownRoute } from './routes/index.js';
+import { attachLocalWebSocketRouting, createPlatformRelay, ensureClaudeSettings, listenWithPortFallback, registerProcessErrorHandlers, setTerminalTitle } from './server-setup.js';
+import { AnalyticsEvents, initAnalytics, shutdownAnalytics, trackEvent } from './services/analytics.js';
+import { AuthService } from './services/auth.js';
+import { ElectronBrowserHost } from './services/browser/host.js';
+import { defaultBrowserHostIpcClientFactory } from './services/browser/ipc-client.js';
+import { registerE2eeIdentityWithPlatform } from './services/e2ee-identity.js';
+import { FileService } from './services/files.js';
+import { InstanceRegistry, identityMatchesSpace, parseSupersededPids, probeInstanceIdentity, } from './services/instances.js';
+import { resolveCliEnvironment } from './services/platform-url.js';
+import { setCurrentMinionryPort } from './services/runtime-info.js';
+import { stopAllAgentSchedulers } from './services/schedule/agent-scheduler.js';
+import { getQualityScheduler, stopAllQualitySchedulers } from './services/schedule/quality-scheduler.js';
+import { stopAllSchedulers } from './services/schedule/scheduler.js';
+import { setSdkBrowserContentGate } from './services/sdk/browser.js';
+import { startAppEndpointReaper } from './services/sdk/endpoints.js';
+import { captureException, flushSentry, initSentry } from './services/sentry.js';
+import { getPTYManager, reloadPty } from './services/terminal/pty-manager.js';
+import { WebSocketImproviseHandler } from './services/websocket/index.js';
+import { abortPostSessionScans } from './services/websocket/post-session-scan.js';
+import { installConsoleTimestamps } from './utils/console-timestamps.js';
+import { MINIONRY_ROOT } from './utils/paths.js';
+delete process.env.npm_config_loglevel;
+installConsoleTimestamps();
+const DEFAULT_PORT = 4101;
+const REQUESTED_PORT = process.env.PORT ? parseInt(process.env.PORT, 10) : DEFAULT_PORT;
+const WORKING_DIR = process.env.MINIONRY_WORKING_DIR || process.env.WORKING_DIR || process.cwd();
+const IS_PRODUCTION = process.env.NODE_ENV === 'production';
+const SERVER_STARTED_AT = new Date().toISOString();
+try {
+    process.chdir(WORKING_DIR);
+}
+catch (err) {
+    console.warn(`Could not chdir to the Space root ${WORKING_DIR}: ${err instanceof Error ? err.message : String(err)}`);
+}
+ensureClaudeSettings(WORKING_DIR);
+setTerminalTitle(WORKING_DIR);
+const app = new Hono();
+const authService = new AuthService();
+const instanceRegistry = new InstanceRegistry();
+const fileService = new FileService(WORKING_DIR);
+const wsHandler = new WebSocketImproviseHandler(instanceRegistry);
+startAppEndpointReaper();
+const browserHost = new ElectronBrowserHost({
+    ipcClientFactory: defaultBrowserHostIpcClientFactory,
+});
+wsHandler.setBrowserHost(browserHost);
+let _currentInstance;
+const PKG_VERSION = (() => {
+    try {
+        const pkg = JSON.parse(readFileSync(join(MINIONRY_ROOT, 'package.json'), 'utf-8'));
+        return pkg.version || '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+})();
+app.use('*', cors({
+    origin: (origin) => {
+        if (!origin)
+            return 'http://localhost';
+        try {
+            const url = new URL(origin);
+            if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') {
+                return origin;
+            }
+        }
+        catch { }
+        return 'http://localhost';
+    }
+}));
+app.use('*', logger());
+const authMiddleware = async (c, next) => {
+    const publicPaths = ['/health', '/api/config'];
+    if (publicPaths.some(path => c.req.path.startsWith(path))) {
+        return next();
+    }
+    const token = c.req.header('x-session-token');
+    if (!token || !authService.validateLocalToken(token)) {
+        return c.json({ error: 'Unauthorized' }, 401);
+    }
+    return next();
+};
+app.use('/api/*', authMiddleware);
+app.get('/health', (c) => c.json({
+    status: 'ok',
+    timestamp: new Date().toISOString(),
+    version: PKG_VERSION,
+    workingDirectory: WORKING_DIR,
+    environment: resolveCliEnvironment(),
+    pid: process.pid,
+    startedAt: SERVER_STARTED_AT,
+}));
+app.get('/api/config', (c) => c.json({ version: PKG_VERSION }));
+app.route('/api/instances', createInstanceRoutes(instanceRegistry));
+app.route('/api/shutdown', createShutdownRoute(instanceRegistry));
+app.route('/api/improvise', createImproviseRoutes(WORKING_DIR));
+app.route('/api/files', createFileRoutes(fileService));
+app.route('/api/notifications', createNotificationRoutes(WORKING_DIR));
+app.route('/internal', createInternalRoutes(wsHandler));
+app.post('/api/reload-pty', async (c) => {
+    const success = await reloadPty();
+    return c.json({ success, available: success });
+});
+app.get('/api/browser/transport', (c) => {
+    return c.json({ transports: [] });
+});
+if (IS_PRODUCTION) {
+}
+app.notFound((c) => c.json({ error: 'Not found' }, 404));
+app.onError((err, c) => {
+    const errorId = randomBytes(4).toString('hex');
+    console.error(`Server error [${errorId}]:`, err);
+    captureException(err, { errorId, path: c.req.path, method: c.req.method });
+    return c.json({
+        error: 'Internal server error',
+        errorId,
+        message: 'Something went wrong. If this persists, report this error ID to support.'
+    }, 500);
+});
+function logStartupBanner(port) {
+    const home = homedir();
+    const displayDir = WORKING_DIR.startsWith(home) ? `~${WORKING_DIR.slice(home.length)}` : WORKING_DIR;
+    console.log(`App: ${displayDir}`);
+    trackEvent(AnalyticsEvents.SERVER_STARTED, { port, working_dir_basename: basename(WORKING_DIR) });
+}
+const SHUTDOWN_DEADLINE_MS = 5_000;
+const SHUTDOWN_FLUSH_BUDGET_MS = 2_000;
+function settleWithin(promise, ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => resolve(undefined), ms);
+        promise.then((value) => { clearTimeout(timer); resolve(value); }, () => { clearTimeout(timer); resolve(undefined); });
+    });
+}
+function makeGracefulShutdown(deps) {
+    let shuttingDown = false;
+    return async () => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        const deadline = setTimeout(() => {
+            console.error('Shutdown deadline reached — exiting now');
+            process.exit(0);
+        }, SHUTDOWN_DEADLINE_MS);
+        deadline.unref();
+        try {
+            abortPostSessionScans();
+            trackEvent(AnalyticsEvents.SERVER_STOPPED);
+            await settleWithin(Promise.all([shutdownAnalytics(), flushSentry()]), SHUTDOWN_FLUSH_BUDGET_MS);
+            deps.wsHandler.collabSessions.flushAll('shutdown');
+            deps.wsHandler.settleExecutingSessions('shutdown');
+            deps.platformConnection.disconnect();
+            instanceRegistry.unregister();
+            stopAllSchedulers();
+            stopAllAgentSchedulers();
+            stopAllQualitySchedulers();
+            getPTYManager().closeAll();
+            await settleWithin(deps.browserHost.stop(), SHUTDOWN_FLUSH_BUDGET_MS);
+            deps.wss.close();
+            console.log('\n\n👋 Shutting down gracefully...\n');
+        }
+        finally {
+            process.exit(0);
+        }
+    };
+}
+const DUPLICATE_GRACE_MS = 10_000;
+const DUPLICATE_POLL_MS = 500;
+function allowDuplicateInstances() {
+    return process.env.MINIONRY_ALLOW_DUPLICATE === '1';
+}
+function describeIdentity(identity) {
+    if (!identity.alive)
+        return 'no answer';
+    if (!identity.workingDirectory || !identity.environment)
+        return 'no identity (older CLI)';
+    return `${identity.workingDirectory} [${identity.environment}]`;
+}
+async function guardSingleInstancePerSpace() {
+    if (allowDuplicateInstances()) {
+        console.warn('MINIONRY_ALLOW_DUPLICATE=1 — the one-server-per-Space guard is OFF for this launch.');
+        return;
+    }
+    const environment = resolveCliEnvironment();
+    const ignorePids = parseSupersededPids(process.env.MINIONRY_SUPERSEDES_PID);
+    const deadline = Date.now() + DUPLICATE_GRACE_MS;
+    for (;;) {
+        const rival = InstanceRegistry.findLiveDuplicate(WORKING_DIR, environment, { ignorePids });
+        if (!rival)
+            return;
+        const identity = await probeInstanceIdentity(rival.port);
+        if (!identity.alive)
+            return;
+        if (!identityMatchesSpace(identity, WORKING_DIR, environment)) {
+            console.warn(`Registry names instance ${rival.id} (pid ${rival.pid}, port ${rival.port}) for this Space, but it reports ${describeIdentity(identity)} — not a confirmed rival; starting.`);
+            return;
+        }
+        if (Date.now() >= deadline) {
+            console.error(`This Space is already served: instance ${rival.id} (pid ${rival.pid}) has ${WORKING_DIR} on port ${rival.port} [${environment}].\n` +
+                'Refusing to start a duplicate — a second server for the same Space fights the first over its relay pairing.\n' +
+                'Set MINIONRY_ALLOW_DUPLICATE=1 to override.');
+            process.exit(0);
+        }
+        await new Promise((r) => setTimeout(r, DUPLICATE_POLL_MS));
+    }
+}
+async function startServer() {
+    await guardSingleInstancePerSpace();
+    await Promise.all([initSentry(), initAnalytics()]);
+    const { server, port } = await listenWithPortFallback({
+        app,
+        preferredPort: REQUESTED_PORT
+    });
+    setCurrentMinionryPort(port);
+    _currentInstance = instanceRegistry.register(port, WORKING_DIR);
+    const wss = new WebSocketServer({ server: server });
+    attachLocalWebSocketRouting({ wss, port, workingDir: WORKING_DIR, authService, wsHandler });
+    logStartupBanner(port);
+    getQualityScheduler(WORKING_DIR).start();
+    let gracefulShutdown = null;
+    const platformConnection = createPlatformRelay(WORKING_DIR, wsHandler, {
+        onSuperseded: () => {
+            console.error(`Superseded by a newer minion instance for ${WORKING_DIR} — shutting down this one.`);
+            void gracefulShutdown?.();
+        },
+    });
+    setSdkBrowserContentGate(() => !platformConnection.isConnectedToPlatform() || platformConnection.isSealingContent());
+    registerE2eeIdentityWithPlatform().catch(() => { });
+    registerProcessErrorHandlers();
+    gracefulShutdown = makeGracefulShutdown({ platformConnection, wss, wsHandler, browserHost });
+    process.on('SIGINT', gracefulShutdown);
+    process.on('SIGTERM', gracefulShutdown);
+}
+startServer();

package/dist/server/mcp/app-tools-bridge.js

@@ -0,0 +1,110 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { getClientId } from '../services/client-id.js';
+import { callAppTool, listAppToolRegistrations, } from '../services/sdk/app-tools.js';
+import { getGrant, getSessionGrant } from '../services/sdk/grant-store.js';
+import { getAppSandboxPaths } from '../services/sdk/sandbox.js';
+import { makeSpaceKey } from '../services/settings.js';
+import { formatDenialMessage, reviewEnginePermission } from './bouncer-integration.js';
+export const APP_TOOLS_MCP_SERVER_NAME = 'minionry-app-tools';
+export const APP_TOOL_NAME_SEPARATOR = '__';
+const TOOLS_SERVE_SCOPE = 'tools:serve';
+function spaceKeyFor(ctx) {
+    return makeSpaceKey(getClientId(), ctx.spaceDir);
+}
+export function exposedToolName(appId, tool) {
+    return `${appId}${APP_TOOL_NAME_SEPARATOR}${tool}`;
+}
+export function splitExposedToolName(name) {
+    const at = name.indexOf(APP_TOOL_NAME_SEPARATOR);
+    if (at <= 0)
+        return null;
+    const appId = name.slice(0, at);
+    const tool = name.slice(at + APP_TOOL_NAME_SEPARATOR.length);
+    if (!appId || !tool)
+        return null;
+    return { appId, tool };
+}
+export function listExposedAppTools(ctx) {
+    const spaceKey = spaceKeyFor(ctx);
+    const exposed = [];
+    for (const registration of listAppToolRegistrations()) {
+        if (registration.spaceKey !== spaceKey)
+            continue;
+        if (ctx.onlyAppId && registration.appId !== ctx.onlyAppId)
+            continue;
+        for (const spec of registration.tools.values()) {
+            exposed.push({
+                name: exposedToolName(registration.appId, spec.name),
+                description: `[${registration.appId}] ${spec.description}`,
+                inputSchema: spec.inputSchema,
+            });
+        }
+    }
+    return exposed;
+}
+export function hasExposedAppTools(ctx) {
+    return listExposedAppTools(ctx).length > 0;
+}
+function failure(code, message) {
+    return { ok: false, code, message };
+}
+function liveGrant(appId, spaceKey, viewerId) {
+    return getGrant(appId, spaceKey) ?? (viewerId ? getSessionGrant(viewerId, appId, spaceKey) : undefined);
+}
+function sandboxDirFor(spaceDir, appId) {
+    try {
+        return getAppSandboxPaths(spaceDir, appId).dataDir;
+    }
+    catch {
+        return '';
+    }
+}
+export async function invokeExposedAppTool(args) {
+    const split = splitExposedToolName(args.name);
+    if (!split) {
+        return failure('BAD_REQUEST', `'${args.name}' is not a valid app tool name (expected '<appId>__<tool>')`);
+    }
+    const { appId, tool } = split;
+    if (args.ctx.onlyAppId && appId !== args.ctx.onlyAppId) {
+        return failure('APP_UNAVAILABLE', `this session may only call tools served by '${args.ctx.onlyAppId}' — '${appId}' is not reachable from it`);
+    }
+    const spaceKey = spaceKeyFor(args.ctx);
+    const registration = listAppToolRegistrations().find((candidate) => candidate.appId === appId && candidate.spaceKey === spaceKey && candidate.tools.has(tool));
+    if (!registration) {
+        return failure('APP_UNAVAILABLE', `no connected app serves '${tool}' for '${appId}' in this Space`);
+    }
+    const grant = liveGrant(appId, spaceKey, registration.viewerId);
+    if (!grant?.scopes.includes(TOOLS_SERVE_SCOPE)) {
+        return failure('SCOPE_DENIED', `'${appId}' no longer holds the '${TOOLS_SERVE_SCOPE}' scope in this Space`);
+    }
+    const input = args.input ?? {};
+    const decision = await reviewEnginePermission({
+        toolName: args.name,
+        input,
+        context: {
+            purpose: `Agent-initiated call into the connected app '${appId}'`,
+            workingDirectory: args.ctx.spaceDir,
+            ...(args.sessionId ? { sessionId: args.sessionId } : {}),
+            source: 'sdk',
+            appId,
+            appOrigin: registration.origin,
+            grantedScopes: [...grant.scopes],
+            sdkWorkspaceDir: args.ctx.spaceDir,
+            sdkSandboxDir: sandboxDirFor(args.ctx.spaceDir, appId),
+        },
+    });
+    if (decision.decision === 'deny') {
+        return failure('SECURITY_BLOCKED', formatDenialMessage(decision));
+    }
+    try {
+        const result = await callAppTool({ appId, spaceKey, tool, input });
+        return { ok: true, result };
+    }
+    catch (error) {
+        const typed = error;
+        const code = typeof typed?.code === 'string' ? typed.code : 'APP_ERROR';
+        const message = error instanceof Error ? error.message : String(error);
+        return failure(code, message);
+    }
+}

package/dist/server/mcp/app-tools-mcp-server.js

@@ -0,0 +1,99 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { Agent } from 'undici';
+const APP_TOOLS_MCP_SERVER_NAME = 'minionry-app-tools';
+const dispatcher = new Agent({ headersTimeout: 0, bodyTimeout: 0 });
+const server = new Server({ name: APP_TOOLS_MCP_SERVER_NAME, version: '1.0.0' }, { capabilities: { tools: {} } });
+function readEnv() {
+    const port = process.env.MINIONRY_PORT;
+    const secret = process.env.MINIONRY_BOUNCER_SECRET;
+    const capabilityToken = process.env.MINIONRY_CAPABILITY_TOKEN;
+    if (!port || !secret || !capabilityToken)
+        return null;
+    return { port, secret, capabilityToken };
+}
+async function post(env, path, body) {
+    const options = {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+            'x-minionry-bouncer-secret': env.secret,
+            'x-minionry-capability-token': env.capabilityToken,
+        },
+        body: JSON.stringify(body),
+    };
+    options.dispatcher = dispatcher;
+    const res = await fetch(`http://127.0.0.1:${env.port}/internal/app-tools/${path}`, options);
+    if (!res.ok) {
+        throw new Error(`/internal/app-tools/${path} returned ${res.status}`);
+    }
+    return res.json();
+}
+server.setRequestHandler(ListToolsRequestSchema, async () => {
+    const env = readEnv();
+    if (!env) {
+        console.error('[MCP AppTools] missing routing context (port/secret/capability token) — exposing no tools');
+        return { tools: [] };
+    }
+    try {
+        const payload = (await post(env, 'list', {}));
+        const tools = Array.isArray(payload?.tools) ? payload.tools : [];
+        console.error(`[MCP AppTools] exposing ${tools.length} app tool(s)`);
+        return {
+            tools: tools.map((tool) => ({
+                name: tool.name,
+                description: tool.description,
+                inputSchema: tool.inputSchema,
+            })),
+        };
+    }
+    catch (err) {
+        console.error(`[MCP AppTools] roster fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+        return { tools: [] };
+    }
+});
+function toMcpResult(outcome) {
+    if (outcome.ok) {
+        const text = outcome.result === undefined ? '' : JSON.stringify(outcome.result);
+        return { content: [{ type: 'text', text }] };
+    }
+    return {
+        content: [{ type: 'text', text: `${outcome.code}: ${outcome.message}` }],
+        isError: true,
+    };
+}
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const env = readEnv();
+    const name = request.params.name;
+    if (!env) {
+        return toMcpResult({
+            ok: false,
+            code: 'APP_UNAVAILABLE',
+            message: `'${name}' cannot be called: this session has no app-tools routing context`,
+        });
+    }
+    const input = (request.params.arguments ?? {});
+    try {
+        const outcome = (await post(env, 'call', { name, input }));
+        return toMcpResult(outcome);
+    }
+    catch (err) {
+        return toMcpResult({
+            ok: false,
+            code: 'APP_UNAVAILABLE',
+            message: `'${name}' could not be delivered: ${err instanceof Error ? err.message : String(err)}`,
+        });
+    }
+});
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error('[MCP AppTools] Server started and ready');
+}
+main().catch((error) => {
+    console.error('[MCP AppTools] Fatal error:', error);
+    process.exit(1);
+});