@mrrlin-dev/mcp 0.4.100 → 0.4.104

package/dist/bin.cjs

@@ -21593,7 +21593,7 @@ args = ${JSON.stringify(expected.args)}
   return tomlStr;
 }
 async function installPublicMcpServerToConfigs(serverId, expected) {
-  const homeDir = import_node_os16.default.homedir();
+  const homeDir = import_node_os17.default.homedir();
   const claudePath = import_node_path37.default.join(homeDir, ".claude.json");
   if (await pathExists5(claudePath)) {
     try {
@@ -21644,12 +21644,12 @@ async function installPublicMcpServerToConfigs(serverId, expected) {
     await writeAtomic(agyPath, JSON.stringify({ mcpServers: { [serverId]: expected } }, null, 2) + "\n");
   }
 }
-var import_promises15, import_node_os16, import_node_path37, toml4;
+var import_promises15, import_node_os17, import_node_path37, toml4;
 var init_install_public_mcp = __esm({
   "src/install-public-mcp.ts"() {
     "use strict";
     import_promises15 = __toESM(require("node:fs/promises"), 1);
-    import_node_os16 = __toESM(require("node:os"), 1);
+    import_node_os17 = __toESM(require("node:os"), 1);
     import_node_path37 = __toESM(require("node:path"), 1);
     toml4 = __toESM(require_toml(), 1);
   }
@@ -21664,7 +21664,7 @@ module.exports = __toCommonJS(bin_exports);
 var import_node_path42 = __toESM(require("node:path"), 1);
 var import_node_child_process23 = require("node:child_process");
 var import_node_fs25 = require("node:fs");
-var import_node_os20 = require("node:os");
+var import_node_os21 = require("node:os");
 var import_node_path43 = __toESM(require("node:path"), 1);
 
 // src/install-codex.ts
@@ -37428,6 +37428,14 @@ var openApiOperationIds = {
   resolveArtifactKindRoute: "resolveArtifactKindRoute",
   resolveDeliveryForArtifactKind: "resolveDeliveryForArtifactKind",
   recordCapabilityUse: "recordCapabilityUse",
+  appendOperatorTranscriptMessage: "appendOperatorTranscriptMessage",
+  listOperatorTranscriptMessages: "listOperatorTranscriptMessages",
+  createIntentProposal: "createIntentProposal",
+  getIntentProposal: "getIntentProposal",
+  recordIntentClarification: "recordIntentClarification",
+  answerIntentClarification: "answerIntentClarification",
+  confirmIntentProposal: "confirmIntentProposal",
+  getIntentConfirmation: "getIntentConfirmation",
   resolveAccount: "resolveAccount",
   linkAccountIdentity: "linkAccountIdentity",
   getMyAccount: "getMyAccount",
@@ -38109,6 +38117,152 @@ var TASK_NOTES_JOURNAL_SECTIONS = [
 ];
 var JOURNAL_HEADING_RE = new RegExp(`^##[ \\t]+(${TASK_NOTES_JOURNAL_SECTIONS.map((s) => s.heading).join("|")})\\b[ \\t]*(?:[\u2014\u2013-][ \\t]*(\\S.*?))?[ \\t]*$`);
 
+// ../../packages/schemas/dist/intent.js
+var taskImpactSchema = external_exports.enum(["low", "medium", "high"]);
+var autonomyLevelSchema = external_exports.enum(["auto", "human_review"]);
+var autoDeploySchema = external_exports.enum(["off", "dev", "prod"]);
+var mrrlinOperatorTranscriptMessageSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  projectSlug: external_exports.string().min(1),
+  content: external_exports.string().min(1),
+  revision: external_exports.number().int().nonnegative().optional(),
+  createdAt: external_exports.string()
+});
+var mrrlinOperatorTranscriptAppendSchema = external_exports.object({
+  content: external_exports.string().min(1)
+});
+var mrrlinOperatorTranscriptListSchema = external_exports.array(mrrlinOperatorTranscriptMessageSchema);
+var operatorTranscriptMessageResponseSchema = external_exports.object({
+  data: mrrlinOperatorTranscriptMessageSchema
+});
+var operatorTranscriptListResponseSchema = external_exports.object({
+  data: mrrlinOperatorTranscriptListSchema
+});
+var mrrlinIntentProposalStateSchema = external_exports.enum([
+  "pending",
+  "confirmed",
+  "rejected",
+  "blocked",
+  "superseded"
+]);
+var mrrlinIntentProposalSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  projectSlug: external_exports.string().min(1),
+  proposalId: external_exports.string().uuid(),
+  version: external_exports.number().int().min(1),
+  state: mrrlinIntentProposalStateSchema,
+  resolvedIntent: external_exports.record(external_exports.string(), external_exports.unknown()),
+  digest: external_exports.string().min(1),
+  messageIds: external_exports.array(external_exports.string().uuid()).default([]),
+  transcriptRevision: external_exports.string(),
+  transcriptRevisionNumber: external_exports.number().int().nonnegative().optional(),
+  createdAt: external_exports.string(),
+  updatedAt: external_exports.string()
+});
+var mrrlinIntentProposalCreateSchema = external_exports.object({
+  proposalId: external_exports.string().uuid(),
+  version: external_exports.number().int().min(1),
+  resolvedIntent: external_exports.record(external_exports.string(), external_exports.unknown()),
+  digest: external_exports.string().min(1),
+  transcriptRevision: external_exports.string().optional(),
+  expectedTranscriptRevisionNumber: external_exports.number().int().nonnegative(),
+  messageIds: external_exports.array(external_exports.string().uuid())
+}).strict();
+var intentProposalResponseSchema = external_exports.object({
+  data: mrrlinIntentProposalSchema
+});
+var intentProposalMaybeResponseSchema = external_exports.object({
+  data: mrrlinIntentProposalSchema.nullable()
+});
+var mrrlinIntentClarificationStateSchema = external_exports.enum(["open", "answered", "rejected"]);
+var mrrlinIntentClarificationSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  projectSlug: external_exports.string().min(1),
+  proposalId: external_exports.string().uuid(),
+  proposalVersion: external_exports.number().int().min(1),
+  round: external_exports.number().int().min(1).max(3),
+  ordinal: external_exports.number().int().min(1).max(3),
+  question: external_exports.string().min(1),
+  state: mrrlinIntentClarificationStateSchema,
+  answer: external_exports.string().nullable().optional(),
+  actor: external_exports.string().nullable().optional(),
+  answeredAt: external_exports.string().nullable().optional(),
+  createdAt: external_exports.string()
+});
+var mrrlinIntentClarificationRecordSchema = external_exports.object({
+  proposalId: external_exports.string().uuid(),
+  proposalVersion: external_exports.number().int().min(1),
+  round: external_exports.number().int().min(1).max(3),
+  ordinal: external_exports.number().int().min(1).max(3),
+  question: external_exports.string().min(1)
+}).strict();
+var mrrlinIntentClarificationAnswerSchema = external_exports.object({
+  answer: external_exports.string().min(1),
+  actor: external_exports.string().min(1).optional()
+}).strict();
+var intentClarificationResponseSchema = external_exports.object({
+  data: mrrlinIntentClarificationSchema
+});
+var mrrlinIntentConfirmRequestSchema = external_exports.object({
+  proposalId: external_exports.string().uuid(),
+  expectedVersion: external_exports.number().int().min(1),
+  expectedDigest: external_exports.string().min(1),
+  actor: external_exports.string().min(1).optional(),
+  materializeParams: external_exports.object({
+    task: external_exports.object({
+      id: external_exports.string().min(1),
+      title: external_exports.string().min(1).optional(),
+      category: external_exports.string().optional(),
+      subcategory: external_exports.string().optional(),
+      impact: taskImpactSchema.optional(),
+      autonomyLevel: autonomyLevelSchema.optional(),
+      autonomyReason: external_exports.string().optional(),
+      autoDeploy: autoDeploySchema.optional(),
+      domains: external_exports.array(external_exports.string()).optional(),
+      tags: external_exports.array(external_exports.string()).optional(),
+      planId: external_exports.string().optional(),
+      specWikiPageId: external_exports.string().optional(),
+      assignee: external_exports.string().optional(),
+      notes: external_exports.string().optional()
+    }).strict().optional(),
+    plan: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+  }).strict().optional()
+}).strict();
+var mrrlinIntentConfirmResponseSchema = external_exports.discriminatedUnion("ok", [
+  external_exports.object({
+    ok: external_exports.literal(true),
+    confirmation_id: external_exports.string().uuid(),
+    proposal_id: external_exports.string().uuid(),
+    proposal_version: external_exports.number().int(),
+    digest: external_exports.string(),
+    task_id: external_exports.string().nullable().optional()
+  }),
+  external_exports.object({
+    ok: external_exports.literal(false),
+    code: external_exports.string(),
+    message: external_exports.string(),
+    expected_version: external_exports.number().optional(),
+    current_state: external_exports.string().optional()
+  })
+]);
+var intentConfirmResultResponseSchema = external_exports.object({
+  data: mrrlinIntentConfirmResponseSchema
+});
+var mrrlinIntentConfirmationSchema = external_exports.object({
+  id: external_exports.string().uuid(),
+  projectSlug: external_exports.string().min(1),
+  proposalId: external_exports.string().uuid(),
+  proposalVersion: external_exports.number().int().min(1),
+  confirmedBy: external_exports.string().min(1),
+  digest: external_exports.string().min(1),
+  transcriptRevision: external_exports.string(),
+  transcriptRevisionNumber: external_exports.number().int().nonnegative().optional(),
+  createdAt: external_exports.string()
+});
+var intentConfirmationMaybeResponseSchema = external_exports.object({
+  data: mrrlinIntentConfirmationSchema.nullable()
+});
+
 // ../../packages/schemas/dist/appsumo.js
 var APPSUMO_CODE_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
 var APPSUMO_ALPHABET_SET = new Set(APPSUMO_CODE_ALPHABET);
@@ -41299,6 +41453,84 @@ function createMrrlinClient(config2) {
         method: "DELETE"
       });
     },
+    // ── Server-Authoritative Intent Methods ─────────────────────────────────
+    async appendOperatorTranscriptMessage(projectSlug, content) {
+      const body = await request(`${projectPath(projectSlug)}/intent/transcript`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ content })
+      });
+      return operatorTranscriptMessageResponseSchema.parse(body).data;
+    },
+    async listOperatorTranscriptMessages(projectSlug) {
+      const body = await request(`${projectPath(projectSlug)}/intent/transcript`);
+      return operatorTranscriptListResponseSchema.parse(body).data;
+    },
+    async createIntentProposal(projectSlug, input) {
+      const body = await request(`${projectPath(projectSlug)}/intent/proposals`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(input)
+      });
+      return intentProposalResponseSchema.parse(body).data;
+    },
+    async getIntentProposal(projectSlug, proposalId, version2) {
+      try {
+        const body = await request(`${projectPath(projectSlug)}/intent/proposals/${encodeURIComponent(proposalId)}/${encodeURIComponent(String(version2))}`);
+        return intentProposalMaybeResponseSchema.parse(body).data;
+      } catch (error51) {
+        if (error51 instanceof MrrlinApiError && error51.status === 404)
+          return null;
+        throw error51;
+      }
+    },
+    async recordIntentClarification(projectSlug, input) {
+      const body = await request(`${projectPath(projectSlug)}/intent/clarifications`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(input)
+      });
+      return intentClarificationResponseSchema.parse(body).data;
+    },
+    async answerIntentClarification(projectSlug, id, input) {
+      const body = await request(`${projectPath(projectSlug)}/intent/clarifications/${encodeURIComponent(id)}/answer`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(input)
+      });
+      return intentClarificationResponseSchema.parse(body).data;
+    },
+    async confirmIntentProposal(projectSlug, proposalId, input) {
+      try {
+        const body = await request(`${projectPath(projectSlug)}/intent/proposals/${encodeURIComponent(proposalId)}/confirm`, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(input)
+        });
+        return intentConfirmResultResponseSchema.parse(body).data;
+      } catch (error51) {
+        if (error51 instanceof MrrlinApiError && (error51.status === 409 || error51.status === 422)) {
+          try {
+            const parsed = JSON.parse(error51.responseBody);
+            const maybeResult = mrrlinIntentConfirmResponseSchema.safeParse(parsed);
+            if (maybeResult.success)
+              return maybeResult.data;
+          } catch {
+          }
+        }
+        throw error51;
+      }
+    },
+    async getIntentConfirmation(projectSlug, proposalId, version2) {
+      try {
+        const body = await request(`${projectPath(projectSlug)}/intent/confirmations/${encodeURIComponent(proposalId)}/${encodeURIComponent(String(version2))}`);
+        return intentConfirmationMaybeResponseSchema.parse(body).data;
+      } catch (error51) {
+        if (error51 instanceof MrrlinApiError && error51.status === 404)
+          return null;
+        throw error51;
+      }
+    },
     async resolveAccount() {
       const body = await request("/auth/account/resolve", {
         method: "POST"
@@ -41404,7 +41636,13 @@ async function resolveIndexPath(input) {
     return import_node_path5.default.resolve(process.env.MRRLIN_WIKI_INDEX_PATH);
   }
   const workspaceRoot = await findWorkspaceRoot();
-  return import_node_path5.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
+  const packageIndexPath = import_node_path5.default.join(workspaceRoot, "packages", "wiki", "wiki-index.json");
+  try {
+    await import_promises3.default.access(packageIndexPath);
+    return packageIndexPath;
+  } catch {
+    return import_node_path5.default.join(workspaceRoot, "apps", "web", "public", "wiki-index.json");
+  }
 }
 async function walkMarkdownFiles(root, dir = root) {
   const entries = await import_promises3.default.readdir(dir, { withFileTypes: true });
@@ -46746,7 +46984,7 @@ async function deliverToWiki(client, projectSlug, payload) {
   return client.updateWikiPage(projectSlug, payload.pageId, payload.patch);
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema = s;
   return !!schema._zod;
@@ -46809,7 +47047,7 @@ function getLiteralValue(schema) {
   return void 0;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [LATEST_PROTOCOL_VERSION, "2025-06-18", "2025-03-26", "2024-11-05", "2024-10-07"];
 var RELATED_TASK_META_KEY = "io.modelcontextprotocol/related-task";
@@ -48329,7 +48567,7 @@ var UrlElicitationRequiredError = class extends McpError {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status) {
   return status === "completed" || status === "failed" || status === "cancelled";
 }
@@ -48340,7 +48578,7 @@ var ignoreOverride = Symbol("Let zodToJsonSchema decide on which parser to use")
 // ../../node_modules/.pnpm/zod-to-json-schema@3.25.2_zod@4.4.3/node_modules/zod-to-json-schema/dist/esm/parsers/string.js
 var ALPHA_NUMERIC = new Set("ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz0123456789");
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function getMethodLiteral(schema) {
   const shape = getObjectShape(schema);
   const methodSchema = shape?.method;
@@ -48361,7 +48599,7 @@ function parseWithCompat(schema, data) {
   return result.data;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 var DEFAULT_REQUEST_TIMEOUT_MSEC = 6e4;
 var Protocol = class {
   constructor(_options) {
@@ -48402,6 +48640,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -48432,12 +48673,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -48474,7 +48715,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -48602,6 +48843,19 @@ var Protocol = class {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -48611,7 +48865,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error51) => this._onerror(new Error(`Failed to send an error response: ${error51}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -48662,7 +48919,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -48697,7 +48957,7 @@ var Protocol = class {
           ...error51["data"] !== void 0 && { data: error51["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -49177,7 +49437,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -49206,12 +49466,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -49315,7 +49576,7 @@ function mergeCapabilities(base, additional) {
   return result;
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
 function createDefaultAjvInstance() {
@@ -49383,7 +49644,7 @@ var AjvJsonSchemaValidator = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/client.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/client.js
 var ExperimentalClientTasks = class {
   constructor(_client) {
     this._client = _client;
@@ -49537,7 +49798,7 @@ var ExperimentalClientTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -49572,7 +49833,7 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/index.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/index.js
 function applyElicitationDefaults(schema, data) {
   if (!schema || data === null || typeof data !== "object")
     return;
@@ -50083,7 +50344,7 @@ var Client = class extends Protocol {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
 var import_content_type = __toESM(require_content_type(), 1);
 function mediaTypeEssence(header) {
   if (!header) {
@@ -50100,7 +50361,7 @@ function mediaTypeEssence(header) {
   }
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/transport.js
 function normalizeHeaders(headers) {
   if (!headers)
     return {};
@@ -50126,6 +50387,68 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
     return baseFetch(url2, mergedInit);
   };
 }
+var MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = [301, 302, 303, 307, 308];
+function isWithinOrigin(from, to) {
+  if (from.protocol === to.protocol && from.hostname === to.hostname && from.port === to.port) {
+    return true;
+  }
+  return from.hostname === to.hostname && from.protocol === "http:" && from.port === "" && to.protocol === "https:" && to.port === "";
+}
+function redirectTarget(response, requestUrl) {
+  const location = REDIRECT_STATUSES.includes(response.status) ? response.headers.get("location") : null;
+  try {
+    return location ? new URL(location, requestUrl) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function followWithinOrigin(baseFetch, url2, init, response, followed = 0) {
+  const target = redirectTarget(response, url2);
+  const keepsMethod = response.status === 307 || response.status === 308 || (init?.method ?? "GET").toUpperCase() === "GET";
+  if (!target || followed === MAX_REDIRECTS || !keepsMethod) {
+    return void 0;
+  }
+  const from = new URL(url2);
+  const addsUserinfo = (target.username || target.password) && (target.username !== from.username || target.password !== from.password);
+  if (addsUserinfo || !isWithinOrigin(from, target)) {
+    return void 0;
+  }
+  return Promise.resolve(response.body?.cancel()).then(() => baseFetch(target, { ...init, redirect: "manual" })).then((next) => followWithinOrigin(baseFetch, target, init, next, followed + 1) ?? next);
+}
+var followingFetches = /* @__PURE__ */ new WeakSet();
+function fetchLeavingRedirects(baseFetch) {
+  const following = (url2, init) => (baseFetch ?? fetch)(url2, init);
+  followingFetches.add(following);
+  return following;
+}
+function fetchWithinOrigin(baseFetch = fetch) {
+  if (followingFetches.has(baseFetch)) {
+    return baseFetch;
+  }
+  return (url2, init) => {
+    if (init?.redirect === "error" || init?.redirect === "manual") {
+      return baseFetch(url2, init);
+    }
+    return Promise.resolve(baseFetch(url2, { ...init, redirect: "manual" })).then((response) => followWithinOrigin(baseFetch, url2, init, response) ?? response);
+  };
+}
+function unfollowedRedirect(response, requestUrl) {
+  if (response.type === "opaqueredirect") {
+    return "Redirect not followed: this runtime does not expose the redirect target";
+  }
+  const from = response.url || requestUrl;
+  const target = redirectTarget(response, from);
+  if (!target) {
+    return void 0;
+  }
+  target.username = target.password = target.search = target.hash = "";
+  if (target.protocol === "http:" && new URL(from).protocol === "https:") {
+    target.protocol = "https:";
+    return `Redirect to plain http not followed; try ${target.href} instead`;
+  }
+  return `Redirect to ${target.href} not followed`;
+}
 
 // ../../node_modules/.pnpm/pkce-challenge@5.0.1/node_modules/pkce-challenge/dist/index.node.js
 var crypto3;
@@ -50170,7 +50493,7 @@ async function pkceChallenge(length) {
   };
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
 var SafeUrlSchema = url().superRefine((val, ctx) => {
   if (!URL.canParse(val)) {
     ctx.addIssue({
@@ -50272,7 +50595,12 @@ var OAuthTokensSchema = object({
   token_type: string2(),
   expires_in: coerce_exports.number().optional(),
   scope: string2().optional(),
-  refresh_token: string2().optional()
+  refresh_token: string2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthErrorResponseSchema = object({
   error: string2(),
@@ -50302,7 +50630,12 @@ var OAuthClientInformationSchema = object({
   client_id: string2(),
   client_secret: string2().optional(),
   client_id_issued_at: number2().optional(),
-  client_secret_expires_at: number2().optional()
+  client_secret_expires_at: number2().optional(),
+  /**
+   * Not part of the wire format: the authorization server this value was obtained from, added by
+   * the client's `auth()` before it is stored and compared when it is read back.
+   */
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
 var OAuthClientRegistrationErrorSchema = object({
@@ -50314,7 +50647,7 @@ var OAuthTokenRevocationRequestSchema = object({
   token_type_hint: string2().optional()
 }).strip();
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
 function resourceUrlFromServerUrl(url2) {
   const resourceURL = typeof url2 === "string" ? new URL(url2) : new URL(url2.href);
   resourceURL.hash = "";
@@ -50334,7 +50667,7 @@ function checkResourceAllowed({ requestedResource, configuredResource }) {
   return requestedPath.startsWith(configuredPath);
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
 var OAuthError = class extends Error {
   constructor(message, errorUri) {
     super(message);
@@ -50429,7 +50762,7 @@ var OAUTH_ERRORS = {
   [InvalidTargetError.errorCode]: InvalidTargetError
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
 var UnauthorizedError = class extends Error {
   constructor(message) {
     super(message ?? "Unauthorized");
@@ -50500,10 +50833,31 @@ async function parseErrorResponse(input) {
     const errorClass = OAUTH_ERRORS[error51] || ServerError;
     return new errorClass(error_description || "", error_uri);
   } catch (error51) {
-    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error51}. Raw body: ${body}`;
+    const redirect = input instanceof Response ? unfollowedRedirect(input, input.url) : void 0;
+    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}${redirect ?? `Invalid OAuth error response: ${error51}. Raw body: ${body}`}`;
     return new ServerError(errorMessage);
   }
 }
+function issuersMatch(a, b) {
+  let [x, y] = [a, b];
+  try {
+    [x, y] = [new URL(a).href, new URL(b).href];
+  } catch {
+  }
+  return x === y || x.endsWith("/") && x.slice(0, -1) === y || y.endsWith("/") && y.slice(0, -1) === x;
+}
+function discardIfIssuerMismatch(stored, issuer) {
+  if (!stored)
+    return void 0;
+  if (typeof stored.issuer !== "string")
+    return stored.issuer == null ? stored : { ...stored, issuer: void 0 };
+  return issuersMatch(stored.issuer, issuer) ? stored : void 0;
+}
+var TokenResponseSchema = OAuthTokensSchema.omit({ issuer: true });
+var RegistrationResponseSchema = OAuthClientInformationFullSchema.omit({ issuer: true });
+function boundElsewhereError(stored, issuer) {
+  return new Error(`OAuth client information is bound to authorization server ${stored.issuer} and is not presented to ${issuer}. Clear the stored client information, or correct \`expectedIssuer\`, if the authorization server has moved.`);
+}
 async function auth(provider, options) {
   try {
     return await authInternal(provider, options);
@@ -50557,9 +50911,24 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       authorizationServerMetadata: metadata
     });
   }
-  const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+  const issuer = String(authorizationServerUrl);
+  const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+  const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
   const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
-  let clientInformation = await Promise.resolve(provider.clientInformation());
+  const storedClientInformation = await Promise.resolve(provider.clientInformation());
+  let clientInformation = discardIfIssuerMismatch(storedClientInformation, issuer);
+  const canRegisterAgain = provider.saveClientInformation !== void 0 && !!provider.redirectUrl;
+  if (storedClientInformation && !clientInformation && !canRegisterAgain) {
+    throw boundElsewhereError(storedClientInformation, issuer);
+  }
+  const unstampedClientInformation = clientInformation?.issuer == null ? clientInformation : void 0;
+  const bindClientInformation = async () => {
+    try {
+      if (unstampedClientInformation)
+        await provider.saveClientInformation?.({ ...unstampedClientInformation, issuer });
+    } catch {
+    }
+  };
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
       throw new Error("Existing OAuth client information is required when exchanging an authorization code");
@@ -50571,9 +50940,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
     }
     const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
     if (shouldUseUrlBasedClientId) {
-      clientInformation = {
-        client_id: clientMetadataUrl
-      };
+      clientInformation = { client_id: clientMetadataUrl, issuer };
       await provider.saveClientInformation?.(clientInformation);
     } else {
       if (!provider.saveClientInformation) {
@@ -50585,8 +50952,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         scope: resolvedScope,
         fetchFn
       });
-      await provider.saveClientInformation(fullInformation);
-      clientInformation = fullInformation;
+      clientInformation = { ...fullInformation, issuer };
+      await provider.saveClientInformation(clientInformation);
     }
   }
   const nonInteractiveFlow = !provider.redirectUrl;
@@ -50597,10 +50964,14 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
       authorizationCode,
       fetchFn
     });
-    await provider.saveTokens(tokens3);
+    await bindClientInformation();
+    await provider.saveTokens({ ...tokens3, issuer });
     return "AUTHORIZED";
   }
-  const tokens2 = await provider.tokens();
+  const tokens2 = discardIfIssuerMismatch(await provider.tokens(), issuer);
+  if (tokens2?.refresh_token && tokens2.issuer == null) {
+    console.warn("[mcp-sdk] stored OAuth tokens have no 'issuer' property (saved by an earlier version, or by a provider that does not keep it) and are used as-is; make sure your OAuthClientProvider stores what saveTokens() and saveClientInformation() receive unchanged.");
+  }
   if (tokens2?.refresh_token) {
     try {
       const newTokens = await refreshAuthorization(authorizationServerUrl, {
@@ -50611,7 +50982,8 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         addClientAuthentication: provider.addClientAuthentication,
         fetchFn
       });
-      await provider.saveTokens(newTokens);
+      await bindClientInformation();
+      await provider.saveTokens({ ...newTokens, issuer });
       return "AUTHORIZED";
     } catch (error51) {
       if (!(error51 instanceof OAuthError) || error51 instanceof ServerError) {
@@ -50710,7 +51082,7 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
 }
 async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
   try {
-    return await fetchFn(url2, { headers });
+    return await fetchWithinOrigin(fetchFn)(url2, { headers });
   } catch (error51) {
     if (error51 instanceof TypeError) {
       if (headers) {
@@ -50735,7 +51107,7 @@ async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
   return await fetchWithCorsRetry(url2, headers, fetchFn);
 }
 function shouldAttemptFallback(response, pathname) {
-  return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
+  return !response || !response.ok && response.status < 500 && pathname !== "/";
 }
 async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
   const issuer = new URL(serverUrl);
@@ -50801,7 +51173,7 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
     }
     if (!response.ok) {
       await response.body?.cancel();
-      if (response.status >= 400 && response.status < 500) {
+      if (response.status < 500) {
         continue;
       }
       throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
@@ -50834,6 +51206,9 @@ async function discoverOAuthServerInfo(serverUrl, opts) {
     resourceMetadata
   };
 }
+function resourceIndicatorToString(resource) {
+  return typeof resource === "string" ? resource : resource.href;
+}
 async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
   let authorizationUrl;
   if (metadata) {
@@ -50865,7 +51240,7 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
     authorizationUrl.searchParams.append("prompt", "consent");
   }
   if (resource) {
-    authorizationUrl.searchParams.set("resource", resource.href);
+    authorizationUrl.searchParams.set("resource", resourceIndicatorToString(resource));
   }
   return { authorizationUrl, codeVerifier };
 }
@@ -50884,7 +51259,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
     Accept: "application/json"
   });
   if (resource) {
-    tokenRequestParams.set("resource", resource.href);
+    tokenRequestParams.set("resource", resourceIndicatorToString(resource));
   }
   if (addClientAuthentication) {
     await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
@@ -50893,7 +51268,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
     const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
     applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
   }
-  const response = await (fetchFn ?? fetch)(tokenUrl, {
+  const response = await fetchWithinOrigin(fetchFn ?? fetch)(tokenUrl, {
     method: "POST",
     headers,
     body: tokenRequestParams
@@ -50901,7 +51276,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthTokensSchema.parse(await response.json());
+  return TokenResponseSchema.parse(await response.json());
 }
 async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
   const tokenRequestParams = new URLSearchParams({
@@ -50919,6 +51294,15 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
   return { refresh_token: refreshToken, ...tokens2 };
 }
 async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
+  const readClientInformation = async () => {
+    const storedClientInformation = await provider.clientInformation();
+    const checked = discardIfIssuerMismatch(storedClientInformation, String(authorizationServerUrl));
+    if (storedClientInformation && !checked) {
+      throw boundElsewhereError(storedClientInformation, String(authorizationServerUrl));
+    }
+    return checked;
+  };
+  let clientInformation = await readClientInformation();
   const scope = provider.clientMetadata.scope;
   let tokenRequestParams;
   if (provider.prepareTokenRequest) {
@@ -50934,11 +51318,11 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
     const codeVerifier = await provider.codeVerifier();
     tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
   }
-  const clientInformation = await provider.clientInformation();
+  clientInformation ?? (clientInformation = await readClientInformation());
   return executeTokenRequest(authorizationServerUrl, {
     metadata,
     tokenRequestParams,
-    clientInformation: clientInformation ?? void 0,
+    clientInformation,
     addClientAuthentication: provider.addClientAuthentication,
     resource,
     fetchFn
@@ -50954,7 +51338,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
   } else {
     registrationUrl = new URL("/register", authorizationServerUrl);
   }
-  const response = await (fetchFn ?? fetch)(registrationUrl, {
+  const response = await fetchWithinOrigin(fetchFn ?? fetch)(registrationUrl, {
     method: "POST",
     headers: {
       "Content-Type": "application/json"
@@ -50967,7 +51351,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
   if (!response.ok) {
     throw await parseErrorResponse(response);
   }
-  return OAuthClientInformationFullSchema.parse(await response.json());
+  return RegistrationResponseSchema.parse(await response.json());
 }
 
 // ../../node_modules/.pnpm/eventsource-parser@3.1.1/node_modules/eventsource-parser/dist/index.js
@@ -51171,7 +51555,7 @@ var EventSourceParserStream = class extends TransformStream {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js
 var DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS = {
   initialReconnectionDelay: 1e3,
   maxReconnectionDelay: 3e4,
@@ -51194,9 +51578,19 @@ var StreamableHTTPClientTransport = class {
     this._authProvider = opts?.authProvider;
     this._fetch = opts?.fetch;
     this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+    this._followRedirects = opts?.redirectPolicy === "follow";
+    if (this._followRedirects) {
+      this._fetch = fetchLeavingRedirects(this._fetch);
+      this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
+    }
     this._sessionId = opts?.sessionId;
     this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
   }
+  /** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */
+  _unfollowedRedirect(response, url2) {
+    const text = unfollowedRedirect(response, url2);
+    return text && !this._followRedirects ? `${text} (redirectPolicy: 'same-origin')` : text;
+  }
   async _authThenStart() {
     if (!this._authProvider) {
       throw new UnauthorizedError("No auth provider");
@@ -51246,11 +51640,13 @@ var StreamableHTTPClientTransport = class {
       if (resumptionToken) {
         headers.set("last-event-id", resumptionToken);
       }
-      const response = await (this._fetch ?? fetch)(this._url, {
-        method: "GET",
-        headers,
-        signal: this._abortController?.signal
-      });
+      const fetchFn = this._fetch ?? fetch;
+      const init = { method: "GET", headers, signal: this._abortController?.signal };
+      let response = await fetchFn(this._url, this._followRedirects ? init : { ...init, redirect: "manual" });
+      const followed = this._followRedirects ? void 0 : followWithinOrigin(fetchFn, this._url, init, response);
+      if (followed) {
+        response = await followed;
+      }
       if (!response.ok) {
         await response.body?.cancel();
         if (response.status === 401 && this._authProvider) {
@@ -51259,7 +51655,7 @@ var StreamableHTTPClientTransport = class {
         if (response.status === 405) {
           return;
         }
-        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${response.statusText}`);
+        throw new StreamableHTTPError(response.status, `Failed to open SSE stream: ${this._unfollowedRedirect(response, this._url) ?? response.statusText}`);
       }
       this._handleSseStream(response.body, options, true);
     } catch (error51) {
@@ -51422,7 +51818,7 @@ var StreamableHTTPClientTransport = class {
         body: JSON.stringify(message),
         signal: this._abortController?.signal
       };
-      const response = await (this._fetch ?? fetch)(this._url, init);
+      const response = await fetchWithinOrigin(this._fetch ?? fetch)(this._url, init);
       const sessionId = response.headers.get("mcp-session-id");
       if (sessionId) {
         this._sessionId = sessionId;
@@ -51474,7 +51870,7 @@ var StreamableHTTPClientTransport = class {
             return this.send(message);
           }
         }
-        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${text}`);
+        throw new StreamableHTTPError(response.status, `Error POSTing to endpoint: ${this._unfollowedRedirect(response, this._url) ?? text}`);
       }
       this._hasCompletedAuthFlow = false;
       this._lastUpscopingHeader = void 0;
@@ -51536,10 +51932,10 @@ var StreamableHTTPClientTransport = class {
         headers,
         signal: this._abortController?.signal
       };
-      const response = await (this._fetch ?? fetch)(this._url, init);
+      const response = await fetchWithinOrigin(this._fetch ?? fetch)(this._url, init);
       await response.body?.cancel();
       if (!response.ok && response.status !== 405) {
-        throw new StreamableHTTPError(response.status, `Failed to terminate session: ${response.statusText}`);
+        throw new StreamableHTTPError(response.status, `Failed to terminate session: ${this._unfollowedRedirect(response, this._url) ?? response.statusText}`);
       }
       this._sessionId = void 0;
     } catch (error51) {
@@ -51568,12 +51964,12 @@ var StreamableHTTPClientTransport = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/stdio.js
 var import_cross_spawn = __toESM(require_cross_spawn(), 1);
 var import_node_process = __toESM(require("node:process"), 1);
 var import_node_stream = require("node:stream");
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 var ReadBuffer = class {
   constructor(options) {
@@ -51610,7 +52006,7 @@ function serializeMessage(message) {
   return JSON.stringify(message) + "\n";
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/stdio.js
 var DEFAULT_INHERITED_ENV_VARS = import_node_process.default.platform === "win32" ? [
   "APPDATA",
   "HOMEDRIVE",
@@ -57770,6 +58166,7 @@ async function verifyProviderReadiness(provider, run3, opts = {}) {
 }
 
 // src/browser-interceptor.ts
+var import_node_os12 = __toESM(require("node:os"), 1);
 var import_node_readline = __toESM(require("node:readline"), 1);
 var import_node_child_process14 = require("node:child_process");
 var INTERNAL_HOST_PATTERNS = [
@@ -57793,8 +58190,7 @@ function isInternalMrrlinUrl(urlString) {
   const trimmed = urlString.trim();
   try {
     const isRelative = trimmed.startsWith("/");
-    const parsedPathname = isRelative ? (trimmed.split("?")[0] ?? "").split("#")[0] ?? "" : "";
-    const parsed = isRelative ? { pathname: parsedPathname, hostname: "localhost" } : new URL(trimmed);
+    const parsed = isRelative ? new URL(trimmed, "http://localhost") : new URL(trimmed);
     const isInternalHost = isRelative || INTERNAL_HOST_PATTERNS.some((p) => p.test(parsed.hostname));
     if (!isInternalHost) {
       return { isInternal: false };
@@ -57823,66 +58219,132 @@ function isInternalMrrlinUrl(urlString) {
 function formatInternalRouteRejectionMessage(url2, suggestedTool) {
   return `[Preflight Guard] Refused to navigate browser to internal route "${url2}". Internal entities must be accessed via fast typed MCP tools directly against the database/API. Suggested tool: ${suggestedTool}. Do NOT open Chromium for internal data retrieval. If browser rendering is strictly required for visual UI testing, pass force_internal: true.`;
 }
-function interceptJsonRpcLine(rawLine) {
+function processClientJsonRpcLine(rawLine) {
   const trimmed = rawLine.trim();
-  if (!trimmed) return null;
+  if (!trimmed) return { type: "forward", payload: rawLine };
   try {
     const msg = JSON.parse(trimmed);
     if (msg && msg.jsonrpc === "2.0" && msg.method === "tools/call" && msg.params?.name === "browser_navigate") {
       const args = msg.params.arguments;
       const url2 = typeof args?.url === "string" ? args.url : "";
-      const forceInternal = Boolean(args?.force_internal);
-      if (!forceInternal && url2) {
+      const forceInternal = args?.force_internal === true;
+      const hadForceInternal = args && typeof args === "object" && "force_internal" in args;
+      if (hadForceInternal) {
+        delete args.force_internal;
+      }
+      if (forceInternal) {
+        return { type: "forward", payload: JSON.stringify(msg) };
+      }
+      if (url2) {
         const check2 = isInternalMrrlinUrl(url2);
         if (check2.isInternal) {
           const rejectionText = formatInternalRouteRejectionMessage(
             url2,
             check2.suggestedTool ?? "get_wiki_page / get_task"
           );
-          return JSON.stringify({
-            jsonrpc: "2.0",
-            id: msg.id,
-            result: {
-              isError: true,
-              content: [
-                {
-                  type: "text",
-                  text: rejectionText
-                }
-              ]
-            }
-          });
+          return {
+            type: "respond",
+            payload: JSON.stringify({
+              jsonrpc: "2.0",
+              id: msg.id,
+              result: {
+                isError: true,
+                content: [
+                  {
+                    type: "text",
+                    text: rejectionText
+                  }
+                ]
+              }
+            })
+          };
         }
       }
+      if (hadForceInternal) {
+        return { type: "forward", payload: JSON.stringify(msg) };
+      }
     }
   } catch {
   }
-  return null;
+  return { type: "forward", payload: rawLine };
+}
+function processChildJsonRpcLine(rawLine) {
+  const trimmed = rawLine.trim();
+  if (!trimmed) return rawLine;
+  try {
+    const msg = JSON.parse(trimmed);
+    if (msg && msg.result && Array.isArray(msg.result.tools)) {
+      const navTool = msg.result.tools.find((t) => t.name === "browser_navigate");
+      if (navTool && navTool.inputSchema) {
+        if (!navTool.inputSchema.properties) {
+          navTool.inputSchema.properties = {};
+        }
+        navTool.inputSchema.properties.force_internal = {
+          type: "boolean",
+          description: "Bypass the preflight guard for internal Mrrlin routes when visual browser rendering is strictly required."
+        };
+        return JSON.stringify(msg);
+      }
+    }
+  } catch {
+  }
+  return rawLine;
 }
 function wireBrowserServeProxy(streams) {
   const { input, output: output3, childIn, childOut } = streams;
+  childIn.on("error", () => {
+  });
   const rl = import_node_readline.default.createInterface({
     input,
     crlfDelay: Infinity,
     terminal: false
   });
+  const childRl = import_node_readline.default.createInterface({
+    input: childOut,
+    crlfDelay: Infinity,
+    terminal: false
+  });
   rl.on("line", (line) => {
-    const intercepted = interceptJsonRpcLine(line);
-    if (intercepted) {
-      output3.write(intercepted + "\n");
+    const action = processClientJsonRpcLine(line);
+    if (action.type === "respond") {
+      output3.write(action.payload + "\n");
     } else {
-      childIn.write(line + "\n");
+      try {
+        childIn.write(action.payload + "\n");
+      } catch {
+      }
+    }
+  });
+  childRl.on("line", (line) => {
+    const augmented = processChildJsonRpcLine(line);
+    try {
+      output3.write(augmented + "\n");
+    } catch {
     }
   });
+  const close = () => {
+    rl.close();
+    childRl.close();
+    try {
+      childIn.end();
+    } catch {
+    }
+  };
   rl.on("close", () => {
     try {
       childIn.end();
     } catch {
     }
   });
-  childOut.on("data", (chunk) => {
-    output3.write(chunk);
-  });
+  return { close };
+}
+function signalToExitCode(signal) {
+  if (!signal) return 1;
+  const sigNum = import_node_os12.default.constants.signals[signal];
+  if (typeof sigNum === "number") {
+    return 128 + sigNum;
+  }
+  return 128 + 15;
 }
 async function runBrowserServeProxy(opts) {
   const input = opts.input ?? process.stdin;
@@ -57894,17 +58356,38 @@ async function runBrowserServeProxy(opts) {
   if (!child.stdin || !child.stdout) {
     throw new Error("Failed to open stdio pipes to @playwright/mcp child process");
   }
-  wireBrowserServeProxy({
+  const proxy = wireBrowserServeProxy({
     input,
     output: output3,
     childIn: child.stdin,
     childOut: child.stdout
   });
+  const sigintHandler = () => {
+    try {
+      child.kill("SIGINT");
+    } catch {
+    }
+  };
+  const sigtermHandler = () => {
+    try {
+      child.kill("SIGTERM");
+    } catch {
+    }
+  };
+  process.on("SIGINT", sigintHandler);
+  process.on("SIGTERM", sigtermHandler);
   return new Promise((resolve2) => {
-    child.on("close", (code) => {
-      resolve2(code ?? 0);
+    child.on("close", (code, signal) => {
+      process.off("SIGINT", sigintHandler);
+      process.off("SIGTERM", sigtermHandler);
+      proxy.close();
+      const exitCode = code !== null ? code : signalToExitCode(signal);
+      resolve2(exitCode);
     });
     child.on("error", (err) => {
+      process.off("SIGINT", sigintHandler);
+      process.off("SIGTERM", sigtermHandler);
+      proxy.close();
       process.stderr.write(`[browser-serve proxy error]: ${err.message}
 `);
       resolve2(1);
@@ -57915,7 +58398,7 @@ async function runBrowserServeProxy(opts) {
 // src/director-bridge.ts
 var import_node_fs23 = __toESM(require("node:fs"), 1);
 var import_node_http = __toESM(require("node:http"), 1);
-var import_node_os17 = __toESM(require("node:os"), 1);
+var import_node_os18 = __toESM(require("node:os"), 1);
 var import_node_path38 = __toESM(require("node:path"), 1);
 var import_node_child_process22 = require("node:child_process");
 var import_node_crypto16 = __toESM(require("node:crypto"), 1);
@@ -58471,7 +58954,7 @@ var import_semver3 = __toESM(require_semver2(), 1);
 // src/codex-auth-preflight.ts
 var import_node_child_process15 = require("node:child_process");
 var import_node_fs11 = require("node:fs");
-var import_node_os12 = __toESM(require("node:os"), 1);
+var import_node_os13 = __toESM(require("node:os"), 1);
 var import_node_path20 = __toESM(require("node:path"), 1);
 var DEFAULT_CODEX_AUTH_MIN_TTL_SECONDS = 15 * 60;
 var DEFAULT_CODEX_AUTH_SMOKE_TIMEOUT_MS = 2e4;
@@ -58491,7 +58974,7 @@ function codexAuthSmokeTimeoutMs(env = process.env) {
 function resolveCodexAuthPath(opts = {}) {
   const env = opts.env ?? process.env;
   const codexHome = env.CODEX_HOME?.trim();
-  return import_node_path20.default.join(codexHome || import_node_path20.default.join(opts.homeDir ?? import_node_os12.default.homedir(), ".codex"), "auth.json");
+  return import_node_path20.default.join(codexHome || import_node_path20.default.join(opts.homeDir ?? import_node_os13.default.homedir(), ".codex"), "auth.json");
 }
 function decodeJwtExpMs(token) {
   const parts = token.split(".");
@@ -58549,7 +59032,7 @@ function runCodexAuthRefreshSmokeForBridgeUpdate(opts = {}) {
   const configuredExecutable = opts.codexExecutable ?? env.MRRLIN_DIRECTOR_BRIDGE_CODEX_BIN?.trim();
   const executable = configuredExecutable || "codex";
   const timeoutMs = opts.timeoutMs ?? codexAuthSmokeTimeoutMs(env);
-  const cwd = opts.cwd ?? import_node_os12.default.tmpdir();
+  const cwd = opts.cwd ?? import_node_os13.default.tmpdir();
   const args = [
     "exec",
     "--sandbox",
@@ -59047,7 +59530,7 @@ Do NOT derail the current task - if the operator has an in-flight question, answ
 }
 
 // src/_generated/version.ts
-var PKG_VERSION = "0.4.100";
+var PKG_VERSION = "0.4.104";
 
 // src/director-closure.ts
 var CLOSURE_SNAPSHOT_TIMEOUT_MS = 2e3;
@@ -59761,7 +60244,7 @@ function parseLedger(value) {
 
 // src/api-base-url-migrate.ts
 var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_os13 = __toESM(require("node:os"), 1);
+var import_node_os14 = __toESM(require("node:os"), 1);
 var import_node_path23 = __toESM(require("node:path"), 1);
 
 // src/service-paths.ts
@@ -59839,7 +60322,7 @@ ${envLines}
 
 // src/api-base-url-migrate.ts
 function defaultDeps(deps) {
-  const home = deps.home ?? process.env.HOME ?? import_node_os13.default.homedir();
+  const home = deps.home ?? process.env.HOME ?? import_node_os14.default.homedir();
   return {
     home,
     codexHome: deps.codexHome ?? process.env.CODEX_HOME?.trim() ?? import_node_path23.default.join(home, ".codex"),
@@ -65524,7 +66007,7 @@ function createToolBusyClock(opts) {
 // src/remote-phone-relay.ts
 var import_node_events3 = require("node:events");
 var import_node_fs20 = require("node:fs");
-var import_node_os14 = require("node:os");
+var import_node_os15 = require("node:os");
 var import_node_path34 = require("node:path");
 
 // ../../node_modules/.pnpm/@noble+hashes@1.3.3/node_modules/@noble/hashes/esm/cryptoNode.js
@@ -69096,7 +69579,7 @@ var DirectorRelay = class {
 
 // src/remote-phone-relay.ts
 function loadOrCreateAgentDeviceKey() {
-  const path29 = (0, import_node_path34.join)((0, import_node_os14.homedir)(), ".mrrlin", "agent-device-key");
+  const path29 = (0, import_node_path34.join)((0, import_node_os15.homedir)(), ".mrrlin", "agent-device-key");
   try {
     const raw = JSON.parse((0, import_node_fs20.readFileSync)(path29, "utf8"));
     if (typeof raw.priv === "string" && typeof raw.pub === "string") {
@@ -69106,7 +69589,7 @@ function loadOrCreateAgentDeviceKey() {
   }
   const kp = generateIdentityKeyPair();
   try {
-    (0, import_node_fs20.mkdirSync)((0, import_node_path34.join)((0, import_node_os14.homedir)(), ".mrrlin"), { recursive: true });
+    (0, import_node_fs20.mkdirSync)((0, import_node_path34.join)((0, import_node_os15.homedir)(), ".mrrlin"), { recursive: true });
     (0, import_node_fs20.writeFileSync)(
       path29,
       JSON.stringify({ priv: toBase64Url(kp.privateKey), pub: toBase64Url(kp.publicKey) }),
@@ -69116,7 +69599,7 @@ function loadOrCreateAgentDeviceKey() {
   }
   return kp;
 }
-var AGENT_PAIRING_PATH = (0, import_node_path34.join)((0, import_node_os14.homedir)(), ".mrrlin", "agent-pairing.json");
+var AGENT_PAIRING_PATH = (0, import_node_path34.join)((0, import_node_os15.homedir)(), ".mrrlin", "agent-pairing.json");
 function loadAgentPairing() {
   try {
     const raw = JSON.parse((0, import_node_fs20.readFileSync)(AGENT_PAIRING_PATH, "utf8"));
@@ -69134,7 +69617,7 @@ function loadAgentPairing() {
 }
 function saveAgentPairing(record2) {
   try {
-    (0, import_node_fs20.mkdirSync)((0, import_node_path34.join)((0, import_node_os14.homedir)(), ".mrrlin"), { recursive: true });
+    (0, import_node_fs20.mkdirSync)((0, import_node_path34.join)((0, import_node_os15.homedir)(), ".mrrlin"), { recursive: true });
     (0, import_node_fs20.writeFileSync)(AGENT_PAIRING_PATH, JSON.stringify(record2), { mode: 384 });
   } catch {
   }
@@ -69640,11 +70123,11 @@ async function readSessionRows(logsDir, files, sessionIds) {
 
 // src/external-agents-scrub.ts
 var import_node_fs22 = __toESM(require("node:fs"), 1);
-var import_node_os15 = __toESM(require("node:os"), 1);
+var import_node_os16 = __toESM(require("node:os"), 1);
 var import_node_path36 = __toESM(require("node:path"), 1);
 var REDACTION = "[REDACTED]";
 var SHORT_VALUE_THRESHOLD = 8;
-var KEYS_ENV_PATH = () => import_node_path36.default.join(import_node_os15.default.homedir(), ".local", "state", "external-agents", "keys.env");
+var KEYS_ENV_PATH = () => import_node_path36.default.join(import_node_os16.default.homedir(), ".local", "state", "external-agents", "keys.env");
 var keysEnvCache = null;
 function readKeysEnv() {
   const filePath = KEYS_ENV_PATH();
@@ -70088,7 +70571,7 @@ function readKnownGptSlugsFromTomlFile(filePath) {
   return Array.from(raw.matchAll(/^\s*model\s*=\s*"([^"]+)"/gm)).map((match) => match[1]?.trim() ?? "").filter(isSelectableModelSlug);
 }
 function readCodexFallbackModels() {
-  const codexHome = process.env.CODEX_HOME?.trim() || import_node_path38.default.join(import_node_os17.default.homedir(), ".codex");
+  const codexHome = process.env.CODEX_HOME?.trim() || import_node_path38.default.join(import_node_os18.default.homedir(), ".codex");
   const models = /* @__PURE__ */ new Map();
   const cachePath = import_node_path38.default.join(codexHome, "models_cache.json");
   const cacheRaw = readTextIfExists(cachePath);
@@ -71254,7 +71737,7 @@ function createBridgeMessageHandler(deps) {
           sendForSpan({ type: "checkout-state", ok: false, error: { code: "invalid_input", fields: { projectSlug: "required" } } });
           return;
         }
-        const state = readCheckoutState(deps.checkoutRegistry, projectSlug, import_node_os17.default.hostname());
+        const state = readCheckoutState(deps.checkoutRegistry, projectSlug, import_node_os18.default.hostname());
         if (!state) {
           sendForSpan({ type: "checkout-state", ok: false, error: { code: "checkout_missing" } });
           return;
@@ -71286,7 +71769,7 @@ function createBridgeMessageHandler(deps) {
         const result = registerCheckout(
           deps.checkoutRegistry,
           { projectSlug, path: typeof msg.path === "string" ? msg.path : "", repo },
-          import_node_os17.default.hostname()
+          import_node_os18.default.hostname()
         );
         if (!result.ok) {
           sendForSpan({ type: "checkout-register", ok: false, error: { code: result.code, detail: result.detail } });
@@ -73552,7 +74035,7 @@ function renderContextPrefix(context) {
   return parts.join("\n\n");
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 var ExperimentalServerTasks = class {
   constructor(_server) {
     this._server = _server;
@@ -73765,7 +74248,7 @@ var ExperimentalServerTasks = class {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server = class extends Protocol {
   /**
    * Initializes this server with the given name and version information.
@@ -74136,7 +74619,7 @@ var Server = class extends Protocol {
   }
 };
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.32.1_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 var import_node_process2 = __toESM(require("node:process"), 1);
 var StdioServerTransport = class {
   constructor(_stdin = import_node_process2.default.stdin, _stdout = import_node_process2.default.stdout, options) {
@@ -74383,7 +74866,7 @@ function runSetCredential(args) {
 }
 
 // src/install-service.ts
-var import_node_os18 = __toESM(require("node:os"), 1);
+var import_node_os19 = __toESM(require("node:os"), 1);
 var import_node_fs24 = require("node:fs");
 var import_node_path39 = __toESM(require("node:path"), 1);
 function parseEnvLine(line, env) {
@@ -74862,11 +75345,11 @@ function installService(deps) {
     deps.log(resolved.reason);
     return { ok: false };
   }
-  const home = deps.env.HOME ?? import_node_os18.default.homedir();
+  const home = deps.env.HOME ?? import_node_os19.default.homedir();
   const user = resolveBridgeUser({
     env: deps.env,
     home,
-    userInfo: deps.userInfo ?? (() => import_node_os18.default.userInfo()),
+    userInfo: deps.userInfo ?? (() => import_node_os19.default.userInfo()),
     homeOwnerUid: deps.homeOwnerUid ?? defaultHomeOwnerUid,
     log: deps.log
   });
@@ -74887,7 +75370,7 @@ function installService(deps) {
   const claudeBin = deps.which("claude");
   const agyBin = deps.which("agy");
   const resolvedBins = [...bins, claudeBin, agyBin].filter((b) => b !== null);
-  const isWin = import_node_os18.default.platform() === "win32";
+  const isWin = import_node_os19.default.platform() === "win32";
   const systemDirs = isWin ? (deps.env.PATH || "").split(import_node_path39.default.delimiter).filter(Boolean) : SYSTEM_PATH_DIRS;
   const pathEnv = Array.from(
     /* @__PURE__ */ new Set([...resolvedBins.map((b) => import_node_path39.default.dirname(b)), ...systemDirs])
@@ -74970,14 +75453,14 @@ function uninstallService(deps) {
 
 // src/uninstall-codex.ts
 var import_promises16 = __toESM(require("node:fs/promises"), 1);
-var import_node_os19 = __toESM(require("node:os"), 1);
+var import_node_os20 = __toESM(require("node:os"), 1);
 var import_node_path40 = __toESM(require("node:path"), 1);
 var toml5 = __toESM(require_toml(), 1);
 function resolveCodexHome3(options) {
   if (options.codexHome) return options.codexHome;
   if (options.homeDir) return import_node_path40.default.join(options.homeDir, ".codex");
   if (process.env.CODEX_HOME) return process.env.CODEX_HOME;
-  return import_node_path40.default.join(import_node_os19.default.homedir(), ".codex");
+  return import_node_path40.default.join(import_node_os20.default.homedir(), ".codex");
 }
 async function pathExists6(target) {
   try {
@@ -75164,7 +75647,7 @@ Missing required flag(s): ${missing.join(
 function augmentProcessPathWithCommonDirs() {
   const isWin = process.platform === "win32";
   if (isWin) return;
-  const home = process.env.HOME || (0, import_node_os20.homedir)();
+  const home = process.env.HOME || (0, import_node_os21.homedir)();
   const candidates = [
     import_node_path43.default.join(home, ".local", "bin"),
     import_node_path43.default.join(home, ".cargo", "bin"),
@@ -75194,11 +75677,11 @@ function bootHookStatus() {
   if (process.platform !== "darwin") return { status: "unknown" };
   const uid = process.getuid?.();
   if (uid === void 0 || uid === 0) return { status: "unknown" };
-  const home = process.env.HOME ?? (0, import_node_os20.homedir)();
+  const home = process.env.HOME ?? (0, import_node_os21.homedir)();
   const agents = import_node_path43.default.join(home, "Library", "LaunchAgents");
   const candidates = [
     { label: "com.mrrlin.director-bridge", plist: import_node_path43.default.join(agents, "com.mrrlin.director-bridge.plist") },
-    { label: "com.PM2", plist: import_node_path43.default.join(agents, `pm2.${(0, import_node_os20.userInfo)().username}.plist`) }
+    { label: "com.PM2", plist: import_node_path43.default.join(agents, `pm2.${(0, import_node_os21.userInfo)().username}.plist`) }
   ];
   for (const candidate of candidates) {
     const printed = (0, import_node_child_process23.spawnSync)("launchctl", ["print", `gui/${uid}/${candidate.label}`], { encoding: "utf8" });
@@ -75480,7 +75963,7 @@ async function main() {
         }
       }
       try {
-        const codexHome = process.env.CODEX_HOME ?? import_node_path43.default.join(process.env.HOME ?? (0, import_node_os20.homedir)(), ".codex");
+        const codexHome = process.env.CODEX_HOME ?? import_node_path43.default.join(process.env.HOME ?? (0, import_node_os21.homedir)(), ".codex");
         (0, import_node_fs25.rmSync)(import_node_path43.default.join(codexHome, "prompts", "report-issue.md"), { force: true });
       } catch {
       }
@@ -75596,14 +76079,14 @@ async function main() {
         purgeSecret: purge,
         secretPath: agentCredentialPath(),
         tokenPath: operatorTokenPath(),
-        ecoPath: import_node_path43.default.join(process.env.HOME ?? (0, import_node_os20.homedir)(), ".mrrlin", "ecosystem.config.cjs"),
+        ecoPath: import_node_path43.default.join(process.env.HOME ?? (0, import_node_os21.homedir)(), ".mrrlin", "ecosystem.config.cjs"),
         log: (m) => process.stderr.write(`[mrrlin-mcp uninstall-service] ${m}
 `)
       });
       return;
     }
     case "uninstall": {
-      const home = process.env.HOME ?? (0, import_node_os20.homedir)();
+      const home = process.env.HOME ?? (0, import_node_os21.homedir)();
       const log = (m) => process.stderr.write(`[mrrlin-mcp uninstall] ${m}
 `);
       uninstallService({