@myagentroam/node 0.1.8 → 0.9.0

package/dist/runner/codex-runner.js

@@ -9,24 +9,147 @@ import { readCodexNativeContextUsage } from '../native-session-history.js';
 import { codexActiveTurnId, codexOfficialConversationPage, codexThreadCwd, codexThreadActivity, deduplicateDirectSessions, externalResumeFailureDetail, extractCodexThreads, isWithinWorkspace, latestNativeActivity } from './codex/conversation-parser.js';
 import { codexSessionControl } from '../codex-app-server.js';
 import { extractId } from '../util/runner-native-session-parsers.js';
+import { nodeLog } from '../operational.js';
+const CODEX_MODEL_CACHE_MS = 10 * 60 * 1_000;
+const CODEX_MODEL_FAILURE_RETRY_MS = 30 * 1_000;
+const CODEX_MODEL_PAGE_SIZE = 100;
 export class CodexRunner extends AbstractRunner {
     client;
+    profileClientFactory;
     name = 'codex';
     discoveryScope = 'ALL_WORKSPACES';
     execution = new CodexExecutionState();
     fastEnabled = false;
     environmentFingerprint;
     environmentRuns = new Set();
-    constructor(client = new CodexAppServerClient()) {
+    profileCache = new Map();
+    profileRefreshes = new Map();
+    profileClients = new Set();
+    profileKeyByEnvironment = new Map();
+    latestProfileCache;
+    selectedProfileKey;
+    constructor(client = new CodexAppServerClient(), profileClientFactory = () => new CodexAppServerClient()) {
         super();
         this.client = client;
+        this.profileClientFactory = profileClientFactory;
     }
     profile(capabilities) {
-        return declaredRunnerProfiles({
+        const base = declaredRunnerProfiles({
             codexAvailable: capabilities.codex.available,
             claudeCodeAvailable: capabilities.claudeCode.available,
             openCodeAvailable: capabilities.openCode?.available === true
         }).find((profile) => profile.runner === this.name);
+        return { ...base, models: this.latestProfileCache?.profile.models ?? [] };
+    }
+    async refreshProfile(capabilities, workspace, environment = {}) {
+        void workspace;
+        const base = this.profile(capabilities);
+        if (!capabilities.codex.available)
+            return { ...base, models: [] };
+        const key = codexEnvironmentFingerprint(environment, capabilities.codex.version);
+        this.profileKeyByEnvironment.set(codexSecretEnvironmentFingerprint(environment), key);
+        this.selectedProfileKey = key;
+        const now = Date.now();
+        const cached = this.profileCache.get(key);
+        if (cached?.successful === true && now < cached.fetchedAt + CODEX_MODEL_CACHE_MS)
+            return this.selectCachedProfile(key, cached);
+        if (cached?.successful === true) {
+            if (now >= cached.retryAt)
+                void this.refreshCodexProfile(key, base, environment);
+            return this.selectCachedProfile(key, cached);
+        }
+        if (cached !== undefined && now < cached.retryAt)
+            return cached.profile;
+        return this.refreshCodexProfile(key, base, environment);
+    }
+    refreshCodexProfile(key, base, environment) {
+        const existing = this.profileRefreshes.get(key);
+        if (existing !== undefined)
+            return existing;
+        const refresh = this.fetchCodexProfile(base, environment)
+            .then((value) => {
+            const cache = {
+                ...value,
+                fetchedAt: Date.now(),
+                successful: true,
+                retryAt: 0
+            };
+            this.profileCache.set(key, cache);
+            if (this.selectedProfileKey === key)
+                this.latestProfileCache = cache;
+            return cache.profile;
+        })
+            .catch((error) => {
+            nodeLog('runner.codex.models.refresh-failed', {
+                error: error instanceof Error ? error.message : String(error)
+            });
+            const cached = this.profileCache.get(key);
+            if (cached !== undefined) {
+                cached.retryAt = Date.now() + CODEX_MODEL_FAILURE_RETRY_MS;
+                return cached.profile;
+            }
+            this.profileCache.set(key, {
+                profile: { ...base, models: [] },
+                defaultConfiguration: emptyCodexConfiguration(),
+                fetchedAt: 0,
+                successful: false,
+                retryAt: Date.now() + CODEX_MODEL_FAILURE_RETRY_MS
+            });
+            return { ...base, models: [] };
+        })
+            .finally(() => this.profileRefreshes.delete(key));
+        this.profileRefreshes.set(key, refresh);
+        return refresh;
+    }
+    selectCachedProfile(key, cached) {
+        if (cached.successful && this.selectedProfileKey === key)
+            this.latestProfileCache = cached;
+        return cached.profile;
+    }
+    async fetchCodexProfile(base, environment) {
+        const client = this.profileClientFactory();
+        this.profileClients.add(client);
+        if (Object.keys(environment).length > 0)
+            client.configureEnvironment(environment);
+        try {
+            await client.start();
+            const models = [];
+            let cursor = null;
+            const cursors = new Set();
+            do {
+                const page = codexModelPage(await client.listModels({ cursor, limit: CODEX_MODEL_PAGE_SIZE, includeHidden: false }));
+                models.push(...page.models);
+                cursor = page.nextCursor;
+                if (cursor !== null && cursors.has(cursor))
+                    throw new Error('CODEX_MODELS_CURSOR_REPEATED');
+                if (cursor !== null)
+                    cursors.add(cursor);
+            } while (cursor !== null);
+            const uniqueModels = models.filter((model, index) => models.findIndex((candidate) => candidate.model === model.model) === index);
+            const profileModels = uniqueModels.map((model) => ({
+                id: model.model,
+                label: model.displayName,
+                supportedEfforts: [...model.supportedEfforts],
+                isDefault: model.isDefault,
+                defaultEffort: model.defaultEffort
+            }));
+            const selected = uniqueModels.find((model) => model.isDefault) ?? uniqueModels[0];
+            return {
+                profile: { ...base, models: profileModels },
+                defaultConfiguration: selected === undefined
+                    ? emptyCodexConfiguration()
+                    : {
+                        runner: this.name,
+                        model: selected.model,
+                        effort: selected.defaultEffort,
+                        access: 'on-request'
+                    }
+            };
+        }
+        finally {
+            if (this.profileClients.delete(client))
+                client.stop();
+        }
     }
     available(capabilities) {
         return capabilities.codex.available;
@@ -44,6 +167,19 @@ export class CodexRunner extends AbstractRunner {
     serviceTier() {
         return this.fastEnabled ? 'fast' : undefined;
     }
+    mcpConfiguration(raw, secrets) {
+        const servers = super.mcpConfiguration(raw, secrets);
+        return Object.fromEntries(servers.map((server) => [
+            server.name,
+            server.transport === 'STDIO'
+                ? {
+                    command: server.command,
+                    args: [...(server.args ?? [])],
+                    env: { ...(server.environment ?? {}) }
+                }
+                : { url: server.url, http_headers: { ...(server.headers ?? {}) } }
+        ]));
+    }
     usesRunnerTitleForRename() {
         return true;
     }
@@ -131,8 +267,23 @@ export class CodexRunner extends AbstractRunner {
             openCode: { available: false }
         });
     }
-    defaultConfiguration() {
-        return { runner: this.name, model: 'gpt-5.6-sol', effort: 'medium', access: 'on-request' };
+    defaultConfiguration(_workspace, environment) {
+        return (this.profileCacheForEnvironment(environment)?.defaultConfiguration ??
+            emptyCodexConfiguration());
+    }
+    supportsConfiguration(configuration, _workspace, environment) {
+        if (configuration.runner !== this.name)
+            return false;
+        const profile = this.profileCacheForEnvironment(environment)?.profile;
+        return (profile !== undefined &&
+            profile.models.some((model) => model.id === configuration.model && model.supportedEfforts.includes(configuration.effort)) &&
+            profile.accessOptions.some((option) => option.id === configuration.access));
+    }
+    profileCacheForEnvironment(environment) {
+        if (environment === undefined)
+            return this.latestProfileCache;
+        const key = this.profileKeyByEnvironment.get(codexSecretEnvironmentFingerprint(environment));
+        return key === undefined ? undefined : this.profileCache.get(key);
     }
     async resumeExternal(external, context, force = false) {
         if (external.runner !== this.name ||
@@ -305,6 +456,9 @@ export class CodexRunner extends AbstractRunner {
         this.environmentFingerprint = undefined;
     }
     stop() {
+        for (const profileClient of this.profileClients)
+            profileClient.stop();
+        this.profileClients.clear();
         this.client.stop();
         if (this.environmentFingerprint !== undefined)
             this.client.clearEnvironment();
@@ -357,6 +511,63 @@ export class CodexRunner extends AbstractRunner {
         return this.client.listCollaborationModes();
     }
 }
+function emptyCodexConfiguration() {
+    return { runner: 'codex', model: '', effort: '', access: 'on-request' };
+}
+function codexEnvironmentFingerprint(environment, version) {
+    return createHash('sha256')
+        .update(JSON.stringify({
+        environment: Object.entries(environment).sort(([left], [right]) => left.localeCompare(right)),
+        version: version ?? null
+    }))
+        .digest('base64url');
+}
+function codexSecretEnvironmentFingerprint(environment) {
+    return createHash('sha256')
+        .update(JSON.stringify(Object.entries(environment).sort(([left], [right]) => left.localeCompare(right))))
+        .digest('base64url');
+}
+function codexModelPage(value) {
+    if (!isPlainRecord(value) || !Array.isArray(value.data))
+        throw new Error('CODEX_MODELS_INVALID');
+    return {
+        models: value.data.flatMap((entry) => {
+            if (!isPlainRecord(entry) || entry.hidden === true)
+                return [];
+            const model = typeof entry.model === 'string' ? entry.model.trim() : '';
+            const displayName = typeof entry.displayName === 'string' ? entry.displayName.trim() : '';
+            const defaultEffort = typeof entry.defaultReasoningEffort === 'string' ? entry.defaultReasoningEffort.trim() : '';
+            const supportedEfforts = Array.isArray(entry.supportedReasoningEfforts)
+                ? entry.supportedReasoningEfforts.flatMap((option) => isPlainRecord(option) && typeof option.reasoningEffort === 'string'
+                    ? [option.reasoningEffort.trim()]
+                    : [])
+                : [];
+            if (model.length === 0 ||
+                model.length > 128 ||
+                displayName.length === 0 ||
+                displayName.length > 128 ||
+                defaultEffort.length === 0 ||
+                defaultEffort.length > 64 ||
+                supportedEfforts.length > 32 ||
+                supportedEfforts.some((effort) => effort.length === 0 || effort.length > 64) ||
+                !supportedEfforts.includes(defaultEffort))
+                return [];
+            return [
+                {
+                    model,
+                    displayName,
+                    isDefault: entry.isDefault === true,
+                    defaultEffort,
+                    supportedEfforts: [...new Set(supportedEfforts.filter(Boolean))]
+                }
+            ];
+        }),
+        nextCursor: typeof value.nextCursor === 'string' && value.nextCursor.length > 0 ? value.nextCursor : null
+    };
+}
+function isPlainRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 export class CodexExecutionState {
     runs = new Map();
     managedTurns = new Map();

package/dist/runner/opencode/managed-run-controller.js

@@ -32,7 +32,7 @@ export class OpenCodeManagedRunController {
                 detail: '后续消息将由 OpenCode 原生 Plan Agent 只读分析并制定计划。',
                 closable: true,
                 closeInput: '/plan',
-                continuation: { label: 'Implement', prompt: '请根据上述计划开始实施。' }
+                continuation: { label: '执行', prompt: '请根据上述计划开始实施。' }
             });
         return { command: command.id, states: this.host.commandStates(session.id) };
     }
@@ -48,9 +48,11 @@ export class OpenCodeManagedRunController {
             this.host.active.has(payload.runId))
             return;
         let environment;
+        let mcp;
         let attachments;
         try {
             environment = parseSecretEnvironment(payload.secretEnvironment);
+            mcp = this.runner.mcpConfiguration(payload.mcpInstallations, environment);
             attachments = this.host.parseAttachments(payload.attachments);
         }
         catch (error) {
@@ -70,7 +72,8 @@ export class OpenCodeManagedRunController {
             environment,
             attachments,
             access: typeof payload.access === 'string' ? payload.access : 'default',
-            agent: payload.collaborationMode === 'plan' ? 'plan' : 'build'
+            agent: payload.collaborationMode === 'plan' ? 'plan' : 'build',
+            mcp
         });
     }
     cancel(runId, intent) {
@@ -119,12 +122,16 @@ export class OpenCodeManagedRunController {
         return true;
     }
     async run(input) {
-        const client = this.runner.managedClient(input.environment);
+        // OpenCode 的动态 MCP 注册属于 Server 进程状态。加载 MCP 的 Run 使用独立 Server，
+        // 避免同一工作区的并行会话共享 MCP 进程、配置或浏览器上下文。
+        const client = this.runner.managedClient(input.environment, hasMcpConfiguration(input.mcp) ? input.runId : undefined);
         this.startingClients.set(input.runId, client);
         this.startingCwds.set(input.runId, input.cwd);
         this.host.active.add(input.runId);
         this.host.emit(input.runId, 'run.started', {}, 'STARTING');
         try {
+            if (hasMcpConfiguration(input.mcp))
+                await client.configureMcp(input.cwd, input.mcp);
             const nativeSessionId = input.externalSessionId ?? openCodeSessionId(await client.createSession(input.cwd));
             if (nativeSessionId === undefined)
                 throw new Error('OPENCODE_SESSION_INVALID');
@@ -359,6 +366,9 @@ export class OpenCodeManagedRunController {
             void this.host.captureSnapshot(runId, cwd);
     }
 }
+function hasMcpConfiguration(value) {
+    return value !== null && typeof value === 'object' && Object.keys(value).length > 0;
+}
 function openCodePart(part, planMode = false) {
     const id = typeof part?.id === 'string' ? part.id : undefined;
     if (id === undefined || typeof part?.type !== 'string')

package/dist/runner/opencode-runner.d.ts

@@ -30,6 +30,7 @@ export declare class OpenCodeRunner extends AbstractRunner<'opencode'> {
     protected profileForValidation(): RunnerProfile;
     supportsConfiguration(configuration: RunnerDefaultConfiguration, workspace?: NodeWorkspace): boolean;
     defaultConfiguration(workspace?: NodeWorkspace): RunnerDefaultConfiguration;
+    mcpConfiguration(raw: unknown, secrets: Readonly<Record<string, string>>): unknown;
     discoverSessions(context: RunnerDiscoveryContext, workspace?: NodeWorkspace): Promise<readonly NodeAgentSession[]>;
     resumeExternal(external: NodeAgentSession, context: ExternalResumeContext): Promise<ExternalResumeResult>;
     readExternalActivity(session: NodeAgentSession): Promise<"UNAVAILABLE" | "EXTERNAL_ACTIVE" | "IDLE">;
@@ -55,6 +56,6 @@ export declare class OpenCodeRunner extends AbstractRunner<'opencode'> {
         maxTokens: number;
     } | undefined>;
     stop(): Promise<void>;
-    managedClient(environment: Readonly<Record<string, string>>): OpenCodeServerClient;
+    managedClient(environment: Readonly<Record<string, string>>, isolationKey?: string): OpenCodeServerClient;
     releaseManagedClient(client: OpenCodeServerClient): void;
 }

package/dist/runner/opencode-runner.js

@@ -87,6 +87,24 @@ export class OpenCodeRunner extends AbstractRunner {
             access: 'default'
         };
     }
+    mcpConfiguration(raw, secrets) {
+        const servers = super.mcpConfiguration(raw, secrets);
+        return Object.fromEntries(servers.map((server) => [
+            server.name,
+            server.transport === 'STDIO'
+                ? {
+                    type: 'local',
+                    command: [server.command, ...(server.args ?? [])],
+                    environment: { ...(server.environment ?? {}) }
+                }
+                : {
+                    type: 'remote',
+                    url: server.url,
+                    headers: { ...(server.headers ?? {}) },
+                    oauth: false
+                }
+        ]));
+    }
     async discoverSessions(context, workspace) {
         const result = [];
         for (const target of workspace === undefined ? context.workspaces : [workspace]) {
@@ -270,11 +288,13 @@ export class OpenCodeRunner extends AbstractRunner {
         await Promise.allSettled(stopping);
         this.stoppingClients.clear();
     }
-    managedClient(environment) {
+    managedClient(environment, isolationKey) {
         const entries = Object.entries(environment).sort(([left], [right]) => left.localeCompare(right));
-        if (entries.length === 0)
+        if (entries.length === 0 && isolationKey === undefined)
             return this.client;
-        const fingerprint = createHash('sha256').update(JSON.stringify(entries)).digest('hex');
+        const fingerprint = createHash('sha256')
+            .update(JSON.stringify({ entries, isolationKey }))
+            .digest('hex');
         const existing = this.environmentClients.get(fingerprint);
         if (existing !== undefined) {
             existing.leases += 1;

package/dist/runner/runner-registry.d.ts

@@ -10,7 +10,7 @@ export declare class RunnerRegistry {
     product(name: unknown): AbstractRunner<RunnerName> | undefined;
     profiles(capabilities: NodeCapabilities): readonly RunnerProfile[];
     refreshProfiles(capabilities: NodeCapabilities, workspace?: import('../database.js').NodeWorkspace, environment?: Readonly<Record<string, string>>): Promise<readonly RunnerProfile[]>;
-    supportsConfiguration(configuration: RunnerDefaultConfiguration, workspace?: import('../database.js').NodeWorkspace): boolean;
+    supportsConfiguration(configuration: RunnerDefaultConfiguration, workspace?: import('../database.js').NodeWorkspace, environment?: Readonly<Record<string, string>>): boolean;
     startManagedRun(envelope: NodeEnvelope): boolean;
     cancelManagedRun(runId: string, intent: RunnerCancellationIntent): boolean;
     decideApproval(input: RunnerApprovalDecision): boolean;

package/dist/runner/runner-registry.js

@@ -38,8 +38,8 @@ export class RunnerRegistry {
         const profiles = await Promise.all(this.advertised().map((runner) => runner.refreshProfile(capabilities, workspace, environment)));
         return profiles.flatMap((profile) => (profile === undefined ? [] : [profile]));
     }
-    supportsConfiguration(configuration, workspace) {
-        return (this.product(configuration.runner)?.supportsConfiguration(configuration, workspace) === true);
+    supportsConfiguration(configuration, workspace, environment) {
+        return (this.product(configuration.runner)?.supportsConfiguration(configuration, workspace, environment) === true);
     }
     startManagedRun(envelope) {
         const runnerName = envelope.payload.runner;

package/dist/runner-profiles.js

@@ -1,38 +1,18 @@
-// Codex reasoning efforts follow the official Codex model surface. Keep this
-// shared so an alias such as GPT-5.6 Luna cannot accidentally lose `high`.
-const CODEX_REASONING_EFFORTS = ['low', 'medium', 'high', 'xhigh'];
 const CLAUDE_MODEL_ENVIRONMENT = {
     opus: 'ANTHROPIC_DEFAULT_OPUS_MODEL',
     sonnet: 'ANTHROPIC_DEFAULT_SONNET_MODEL',
     haiku: 'ANTHROPIC_DEFAULT_HAIKU_MODEL'
 };
 /**
- * The Runner APIs used by MAR do not expose a portable model-list endpoint.
- * Keep the supported, product-visible choices in one Node-owned definition so
- * the browser never guesses models, effort levels, permission modes, or slash
- * commands. Model aliases for Claude are accepted by the Agent SDK and avoid
- * coupling the UI to a vendor version suffix.
+ * Keep product-visible permission modes and slash commands in one Node-owned
+ * definition. Codex models are supplied by App Server `model/list`; Claude
+ * aliases are accepted by the Agent SDK and avoid coupling the UI to a vendor
+ * version suffix.
  */
 const definitions = {
     codex: {
         runner: 'codex',
-        models: [
-            {
-                id: 'gpt-5.6-sol',
-                label: 'GPT-5.6 Sol',
-                supportedEfforts: [...CODEX_REASONING_EFFORTS]
-            },
-            {
-                id: 'gpt-5.6-terra',
-                label: 'GPT-5.6 Terra',
-                supportedEfforts: [...CODEX_REASONING_EFFORTS]
-            },
-            {
-                id: 'gpt-5.6-luna',
-                label: 'GPT-5.6 Luna',
-                supportedEfforts: [...CODEX_REASONING_EFFORTS]
-            }
-        ],
+        models: [],
         accessOptions: [
             { id: 'on-request', label: 'On-request', description: '由 Codex 在需要额外权限时请求确认。' },
             {

package/dist/runtime-command-detector.d.ts

@@ -0,0 +1,3 @@
+import type { RuntimeCommand } from '@myagentroam/protocol';
+export declare function detectRuntimeCommands(): Promise<RuntimeCommand[]>;
+export declare function normalizeVersion(id: RuntimeCommand['id'], value: string): string | undefined;

package/dist/runtime-command-detector.js

@@ -0,0 +1,78 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const COMMANDS = [
+    { id: 'npx', candidates: ['npx'], versionArguments: ['--version'] },
+    { id: 'git', candidates: ['git'], versionArguments: ['--version'] },
+    { id: 'python', candidates: ['python3', 'python'], versionArguments: ['--version'] },
+    { id: 'pip', candidates: ['pip3', 'pip'], versionArguments: ['--version'] }
+];
+export async function detectRuntimeCommands() {
+    return Promise.all(COMMANDS.map(detectCommand));
+}
+async function detectCommand(descriptor) {
+    for (const command of descriptor.candidates) {
+        try {
+            const [{ stdout, stderr }, path] = await Promise.all([
+                executeVersion(command, descriptor.versionArguments),
+                resolveCommandPath(command)
+            ]);
+            const version = normalizeVersion(descriptor.id, `${stdout}${stderr}`.trim().split(/\r?\n/u)[0]?.trim() ?? '');
+            return {
+                id: descriptor.id,
+                command,
+                available: true,
+                ...(version === undefined || version === '' ? {} : { version }),
+                ...(path === undefined ? {} : { path })
+            };
+        }
+        catch {
+            // Try the platform-compatible fallback command name.
+        }
+    }
+    return {
+        id: descriptor.id,
+        command: descriptor.candidates[0],
+        available: false
+    };
+}
+export function normalizeVersion(id, value) {
+    const normalized = value.trim();
+    if (normalized === '')
+        return undefined;
+    const patterns = {
+        git: /^git version\s+(\S+)/iu,
+        python: /^python\s+(\S+)/iu,
+        pip: /^pip\s+(\S+)/iu
+    };
+    const match = patterns[id]?.exec(normalized);
+    return (match?.[1] ?? normalized).slice(0, 512);
+}
+async function executeVersion(command, args) {
+    const executable = process.platform === 'win32' ? process.env['ComSpec'] || 'cmd.exe' : command;
+    const commandArgs = process.platform === 'win32'
+        ? ['/d', '/s', '/c', [command, ...args].map(quoteWindowsArgument).join(' ')]
+        : [...args];
+    return execFileAsync(executable, commandArgs, {
+        timeout: 5_000,
+        maxBuffer: 64 * 1024,
+        windowsHide: true
+    });
+}
+function quoteWindowsArgument(value) {
+    return `"${value.replaceAll('"', '""')}"`;
+}
+async function resolveCommandPath(command) {
+    try {
+        const resolver = process.platform === 'win32' ? 'where.exe' : 'which';
+        const { stdout } = await execFileAsync(resolver, [command], {
+            timeout: 2_000,
+            maxBuffer: 64 * 1024,
+            windowsHide: true
+        });
+        return stdout.trim().split(/\r?\n/u)[0]?.trim().slice(0, 2048) || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/service/mcp-installation-verifier.d.ts

@@ -0,0 +1,9 @@
+import type { McpCatalogEntry, McpInstallationConfiguration } from '@myagentroam/protocol';
+export declare class McpInstallationVerifier {
+    verify(input: {
+        readonly entry: McpCatalogEntry;
+        readonly configuration: McpInstallationConfiguration;
+        readonly secrets: Readonly<Record<string, string>>;
+        readonly cwd: string;
+    }): Promise<void>;
+}

package/dist/service/mcp-installation-verifier.js

@@ -0,0 +1,87 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+const INSTALL_TIMEOUT_MS = 90_000;
+export class McpInstallationVerifier {
+    async verify(input) {
+        const client = new Client({ name: 'myagentroam-node-installer', version: '0.9.0' });
+        try {
+            await withTimeout((async () => {
+                if (input.entry.runtime.transport === 'STDIO') {
+                    await client.connect(new StdioClientTransport({
+                        command: input.entry.runtime.command,
+                        args: [...input.entry.runtime.args, ...(input.configuration.arguments ?? [])],
+                        env: {
+                            ...getDefaultEnvironment(),
+                            ...resolveReferences(input.entry.runtime.environment, input.secrets),
+                            ...resolveReferences(input.configuration.environment, input.secrets)
+                        },
+                        cwd: input.cwd,
+                        stderr: 'pipe'
+                    }));
+                }
+                else {
+                    await client.connect(new StreamableHTTPClientTransport(new URL(input.entry.runtime.url), {
+                        requestInit: {
+                            headers: {
+                                ...resolveReferences(input.entry.runtime.headers, input.secrets),
+                                ...resolveReferences(input.configuration.headers, input.secrets)
+                            }
+                        }
+                    }));
+                }
+                const tools = await client.listTools();
+                if (tools.tools.length === 0)
+                    throw new Error('MCP_TOOLS_UNAVAILABLE');
+            })());
+        }
+        catch (error) {
+            throw installError(error);
+        }
+        finally {
+            await Promise.race([client.close().catch(() => undefined), delay(2_000)]);
+        }
+    }
+}
+function resolveReferences(references, secrets) {
+    const result = {};
+    for (const [name, reference] of Object.entries(references ?? {})) {
+        const value = secrets[reference.secretName];
+        if (value === undefined)
+            throw new Error('MCP_SECRET_MISSING');
+        result[name] = value;
+    }
+    return result;
+}
+async function withTimeout(operation) {
+    let timer;
+    try {
+        await Promise.race([
+            operation,
+            new Promise((_resolve, reject) => {
+                timer = setTimeout(() => reject(new Error('MCP_INSTALL_TIMEOUT')), INSTALL_TIMEOUT_MS);
+            })
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+function installError(error) {
+    const message = error instanceof Error ? error.message : '';
+    if (message === 'MCP_INSTALL_TIMEOUT' ||
+        message === 'MCP_SECRET_MISSING' ||
+        message === 'MCP_TOOLS_UNAVAILABLE')
+        return new Error(message);
+    if (/401|403|unauthorized|forbidden/iu.test(message))
+        return new Error('MCP_AUTH_FAILED');
+    if (/ENOENT|spawn/iu.test(message))
+        return new Error('MCP_COMMAND_UNAVAILABLE');
+    if (/fetch|connect|network|ECONN|ENOTFOUND/iu.test(message))
+        return new Error('MCP_CONNECTION_FAILED');
+    return new Error('MCP_PROTOCOL_VALIDATION_FAILED');
+}
+function delay(milliseconds) {
+    return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}

package/dist/service/mcp-node-operation-service.d.ts

@@ -0,0 +1,11 @@
+import type { NodeDatabase } from '../database.js';
+import { McpInstallationVerifier } from './mcp-installation-verifier.js';
+export declare class McpNodeOperationService {
+    private readonly requireDatabase;
+    private readonly verifier;
+    constructor(requireDatabase: () => NodeDatabase, verifier?: McpInstallationVerifier);
+    operations(): Readonly<Record<string, (data: unknown) => unknown>>;
+    private inspect;
+    private install;
+    private remove;
+}