@nac3/forge-cli 0.2.0-alpha.8 → 0.2.1-alpha.60

package/dist/mcp/blocklist.d.ts

@@ -0,0 +1,19 @@
+export declare const BLOCKLIST_VERSION = 1;
+export interface BlockedEndpoint {
+    /** Normalised "host:port" or "scheme://host:port" form. */
+    endpoint: string;
+    /** ISO 8601 timestamp of the block. */
+    blocked_at: string;
+    /** Optional free-text reason the user supplied. */
+    reason?: string;
+}
+/** Canonicalise an endpoint string so block("192.168.1.5:3000")
+ *  matches isBlocked("http://192.168.1.5:3000/"). */
+export declare function normaliseEndpoint(raw: string): string;
+export declare function listBlocked(): Promise<BlockedEndpoint[]>;
+export declare function isBlocked(endpoint: string): Promise<boolean>;
+export declare function blockEndpoint(endpoint: string, reason?: string): Promise<BlockedEndpoint>;
+export declare function unblockEndpoint(endpoint: string): Promise<boolean>;
+/** Test seam: drop the on-disk file. */
+export declare function _resetBlocklistForTest(): Promise<void>;
+//# sourceMappingURL=blocklist.d.ts.map

package/dist/mcp/blocklist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist.d.ts","sourceRoot":"","sources":["../../src/mcp/blocklist.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD;qDACqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKrD;AA8BD,wBAAsB,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAG9D;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIlE;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAc/F;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASxE;AAED,wCAAwC;AACxC,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAG5D"}

package/dist/mcp/blocklist.js

@@ -0,0 +1,118 @@
+/**
+ * MCP LAN scan blocklist (F101 sec B -- persisted denylist).
+ *
+ * When the user clicks "Bloquear permanente" on a LAN-discovered
+ * endpoint, the endpoint goes here. Subsequent LAN scans skip
+ * blocked endpoints; subsequent authorize attempts refuse.
+ *
+ * Storage: ~/.yujin-forge/mcp-blocklist.json (NOT in the vault --
+ * the data is not secret, it is policy). Atomic write through
+ * renameWithRetry to survive Windows handle races.
+ *
+ * Schema (append-only -- bump VERSION on any breaking change):
+ *
+ *   {
+ *     v: 1,
+ *     blocked: [
+ *       { endpoint: "192.168.1.55:8080", blocked_at: "2026-...",
+ *         reason?: "user-classified spam" },
+ *       ...
+ *     ]
+ *   }
+ *
+ * ASCII-only.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { renameWithRetry } from '../core/atomic_write.js';
+export const BLOCKLIST_VERSION = 1;
+const FILENAME = 'mcp-blocklist.json';
+function configRoot() {
+    return process.env['YF_CONFIG_DIR']
+        ?? path.join(process.env['HOME'] || process.env['USERPROFILE'] || os.homedir(), '.yujin-forge');
+}
+function blocklistFile() {
+    return path.join(configRoot(), FILENAME);
+}
+/** Canonicalise an endpoint string so block("192.168.1.5:3000")
+ *  matches isBlocked("http://192.168.1.5:3000/"). */
+export function normaliseEndpoint(raw) {
+    let s = (raw ?? '').trim().toLowerCase();
+    s = s.replace(/^https?:\/\//, '');
+    s = s.replace(/\/+$/, '');
+    return s;
+}
+function emptyFile() { return { v: BLOCKLIST_VERSION, blocked: [] }; }
+async function readBlocklistFile() {
+    const f = blocklistFile();
+    try {
+        const raw = await fs.readFile(f, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.blocked)) {
+            return emptyFile();
+        }
+        return parsed;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return emptyFile();
+        /* Corrupted file -> behave as empty, but do NOT silently overwrite.
+         * The next call to a mutator will write a fresh file; the user
+         * can recover by inspecting the .bak if they kept one. */
+        return emptyFile();
+    }
+}
+async function writeBlocklistFile(file) {
+    const f = blocklistFile();
+    await fs.mkdir(path.dirname(f), { recursive: true });
+    const tmp = f + '.tmp';
+    await fs.writeFile(tmp, JSON.stringify(file, null, 2), 'utf-8');
+    await renameWithRetry(tmp, f);
+}
+export async function listBlocked() {
+    const file = await readBlocklistFile();
+    return file.blocked.slice();
+}
+export async function isBlocked(endpoint) {
+    const norm = normaliseEndpoint(endpoint);
+    const file = await readBlocklistFile();
+    return file.blocked.some((b) => normaliseEndpoint(b.endpoint) === norm);
+}
+export async function blockEndpoint(endpoint, reason) {
+    const norm = normaliseEndpoint(endpoint);
+    if (!norm)
+        throw new Error('blockEndpoint: empty endpoint');
+    const file = await readBlocklistFile();
+    const existing = file.blocked.find((b) => normaliseEndpoint(b.endpoint) === norm);
+    if (existing)
+        return existing;
+    const entry = {
+        endpoint: norm,
+        blocked_at: new Date().toISOString(),
+        ...(reason && reason.trim() ? { reason: reason.trim().slice(0, 240) } : {}),
+    };
+    file.blocked.push(entry);
+    await writeBlocklistFile(file);
+    return entry;
+}
+export async function unblockEndpoint(endpoint) {
+    const norm = normaliseEndpoint(endpoint);
+    if (!norm)
+        return false;
+    const file = await readBlocklistFile();
+    const before = file.blocked.length;
+    file.blocked = file.blocked.filter((b) => normaliseEndpoint(b.endpoint) !== norm);
+    if (file.blocked.length === before)
+        return false;
+    await writeBlocklistFile(file);
+    return true;
+}
+/** Test seam: drop the on-disk file. */
+export async function _resetBlocklistForTest() {
+    try {
+        await fs.unlink(blocklistFile());
+    }
+    catch { /* not present */ }
+}
+//# sourceMappingURL=blocklist.js.map

package/dist/mcp/blocklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist.js","sourceRoot":"","sources":["../../src/mcp/blocklist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAgBnC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;AAEtC,SAAS,UAAU;IACjB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;WAC5B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACtG,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;qDACqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,SAAS,KAAoB,OAAO,EAAE,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAErF,KAAK,UAAU,iBAAiB;IAC9B,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5E,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,EAAE,CAAC;QACzE;;kEAE0D;QAC1D,OAAO,SAAS,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAmB;IACnD,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;IAC1B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB;IAC9C,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,MAAe;IACnE,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IAClF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAoB;QAC7B,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IACnC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IAClF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IAAC,CAAC;IACzC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC7B,CAAC"}

package/dist/mcp/bridge_registry.d.ts

@@ -0,0 +1,77 @@
+/**
+ * F101 alpha.60 slice 1 -- MCPBridgeRegistry: discovery of
+ * MCP bridges from 4 sources.
+ *
+ * Per docs/F101_MCP_BRIDGE.md section 1.4 (Q4 autodiscovery),
+ * each `yf chat` startup scans 4 places in parallel:
+ *
+ *   1. Loopback scan -- common ports (3001-3010, 5000, 8000,
+ *      8080) with 200ms timeout each. The MCP server responds
+ *      to GET /.well-known/mcp -> discovered. Loopback only,
+ *      never LAN by default.
+ *   2. Active project manifest -- if the NAC-3 manifest
+ *      declares `mcp_bridges: [...]`, those activate
+ *      automatically.
+ *   3. File convention -- `.yujin-forge/mcp-bridges.json` in
+ *      home + in the project. Read if present.
+ *   4. Env vars -- YUJIN_MCP_BRIDGES="crm:http://localhost:3001,
+ *      slack:http://localhost:3002".
+ *
+ * Hard cap: 10 active bridges. Loopback only (no LAN scanning
+ * in this slice; LAN scan is opt-in via Config in alpha.64).
+ *
+ * Returned shape: a deduplicated list of MCPBridge records.
+ *
+ * ASCII-only.
+ */
+export interface MCPBridge {
+    /** Stable kebab-case identifier. Used as namespace prefix when
+     *  invoking proxied verbs (`crm.list_companies`). */
+    id: string;
+    /** Full base URL of the MCP server. For stdio bridges, set to
+     *  the empty string or a sentinel path; the command field is
+     *  what is invoked. */
+    endpoint: string;
+    /** Where this bridge came from: 'loopback' | 'manifest' | 'file' | 'env'. */
+    source: 'loopback' | 'manifest' | 'file' | 'env';
+    /** Whether this bridge is currently enabled (default true). User
+     *  can flip via `yf mcp disable <id>`. */
+    enabled: boolean;
+    /** Optional pretty name shown in CLI output. */
+    display_name?: string;
+    /** F101 slice 4 FULL -- MCP transport protocol. Defaults to
+     *  'http_rest' when omitted (preserves slice 4 minimal behaviour
+     *  byte-for-byte). 'stdio' spawns the command; 'sse' uses
+     *  Server-Sent Events. */
+    protocol?: 'http_rest' | 'stdio' | 'sse';
+    /** Shell command for protocol === 'stdio'. Ignored otherwise. */
+    command?: string;
+}
+export interface DiscoveryOptions {
+    /** Project root (used by source 2 + 3). Optional. */
+    projectRoot?: string;
+    /** Max ms to wait for a single loopback probe. Default 200. */
+    loopbackTimeoutMs?: number;
+    /** Ports to scan in loopback. Default: 3001-3010 + 5000 + 8000 + 8080. */
+    loopbackPorts?: number[];
+    /** Hard cap on active bridges. Default 10. */
+    maxActive?: number;
+}
+declare function dedupePreservePrecedence(bridges: MCPBridge[]): MCPBridge[];
+/** Run all 4 discovery sources in parallel + dedupe + cap +
+ *  merge the persistent enabled-state from F101 slice 5
+ *  sub-slice 1 (~/.yujin-forge/mcp-state.json). A bridge marked
+ *  disabled in state surfaces with enabled:false; downstream
+ *  consumers (manifest stub, invoke-tool) filter accordingly. */
+export declare function discoverBridges(opts?: DiscoveryOptions): Promise<MCPBridge[]>;
+export declare function getActiveBridges(opts?: DiscoveryOptions & {
+    refresh?: boolean;
+}): Promise<MCPBridge[]>;
+/** Clear the cache (used in tests + by yf mcp scan). */
+export declare function resetBridgeCache(): void;
+export declare const _internal: {
+    dedupePreservePrecedence: typeof dedupePreservePrecedence;
+    SOURCE_RANK: Record<"manifest" | "env" | "loopback" | "file", number>;
+};
+export {};
+//# sourceMappingURL=bridge_registry.d.ts.map

package/dist/mcp/bridge_registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge_registry.d.ts","sourceRoot":"","sources":["../../src/mcp/bridge_registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAUH,MAAM,WAAW,SAAS;IACxB;yDACqD;IACrD,EAAE,EAAE,MAAM,CAAC;IACX;;2BAEuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC;IACjD;8CAC0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;8BAG0B;IAC1B,QAAQ,CAAC,EAAE,WAAW,GAAG,OAAO,GAAG,KAAK,CAAC;IACzC,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAyJD,iBAAS,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,CASnE;AAMD;;;;iEAIiE;AACjE,wBAAsB,eAAe,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CA6BvF;AAOD,wBAAsB,gBAAgB,CAAC,IAAI,GAAE,gBAAgB,GAAG;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAOhH;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED,eAAO,MAAM,SAAS;;;CAA4C,CAAC"}

package/dist/mcp/bridge_registry.js

@@ -0,0 +1,220 @@
+/**
+ * F101 alpha.60 slice 1 -- MCPBridgeRegistry: discovery of
+ * MCP bridges from 4 sources.
+ *
+ * Per docs/F101_MCP_BRIDGE.md section 1.4 (Q4 autodiscovery),
+ * each `yf chat` startup scans 4 places in parallel:
+ *
+ *   1. Loopback scan -- common ports (3001-3010, 5000, 8000,
+ *      8080) with 200ms timeout each. The MCP server responds
+ *      to GET /.well-known/mcp -> discovered. Loopback only,
+ *      never LAN by default.
+ *   2. Active project manifest -- if the NAC-3 manifest
+ *      declares `mcp_bridges: [...]`, those activate
+ *      automatically.
+ *   3. File convention -- `.yujin-forge/mcp-bridges.json` in
+ *      home + in the project. Read if present.
+ *   4. Env vars -- YUJIN_MCP_BRIDGES="crm:http://localhost:3001,
+ *      slack:http://localhost:3002".
+ *
+ * Hard cap: 10 active bridges. Loopback only (no LAN scanning
+ * in this slice; LAN scan is opt-in via Config in alpha.64).
+ *
+ * Returned shape: a deduplicated list of MCPBridge records.
+ *
+ * ASCII-only.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { homedir } from 'node:os';
+const DEFAULT_PORTS = [3001, 3002, 3003, 3004, 3005, 3006, 3007, 3008, 3009, 3010, 5000, 8000, 8080];
+const HOME_FILE_DIR = '.yujin-forge';
+const HOME_FILE_NAME = 'mcp-bridges.json';
+const PROJECT_FILE_PATH = '.yujin-forge/mcp-bridges.json';
+/* ===================================================================
+ * Source 1 -- loopback scan
+ * ================================================================ */
+async function probeLoopbackPort(port, timeoutMs) {
+    const url = 'http://127.0.0.1:' + port + '/.well-known/mcp';
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const r = await fetch(url, { signal: controller.signal });
+        clearTimeout(timer);
+        if (!r.ok)
+            return null;
+        const body = await r.json().catch(() => null);
+        /* The MCP server is expected to identify itself via the
+         * well-known endpoint. Fall back to a port-derived id. */
+        const id = (body && typeof body.id === 'string' && body.id) || ('local-' + port);
+        return {
+            id,
+            endpoint: 'http://127.0.0.1:' + port,
+            source: 'loopback',
+            enabled: true,
+            display_name: body?.name,
+        };
+    }
+    catch {
+        clearTimeout(timer);
+        return null;
+    }
+}
+async function discoverFromLoopback(ports, timeoutMs) {
+    const probes = ports.map((p) => probeLoopbackPort(p, timeoutMs));
+    const results = await Promise.all(probes);
+    return results.filter((b) => b !== null);
+}
+async function discoverFromManifest(projectRoot) {
+    const manifestPath = path.join(projectRoot, 'yujin.forge.json');
+    try {
+        const raw = await fs.readFile(manifestPath, 'utf-8');
+        const json = JSON.parse(raw);
+        if (!Array.isArray(json.mcp_bridges))
+            return [];
+        return json.mcp_bridges
+            .filter((b) => typeof b.id === 'string' && typeof b.endpoint === 'string')
+            .map((b) => ({
+            id: b.id,
+            endpoint: b.endpoint,
+            source: 'manifest',
+            enabled: true,
+            display_name: b.display_name,
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+async function readBridgesFile(file, source) {
+    try {
+        const raw = await fs.readFile(file, 'utf-8');
+        const json = JSON.parse(raw);
+        if (!Array.isArray(json.bridges))
+            return [];
+        return json.bridges
+            .filter((b) => typeof b.id === 'string' && typeof b.endpoint === 'string')
+            .map((b) => ({
+            id: b.id,
+            endpoint: b.endpoint,
+            source,
+            enabled: b.enabled !== false,
+            display_name: b.display_name,
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+async function discoverFromFiles(projectRoot) {
+    const homeFile = path.join(homedir(), HOME_FILE_DIR, HOME_FILE_NAME);
+    const result = [];
+    result.push(...await readBridgesFile(homeFile, 'file'));
+    if (projectRoot) {
+        const projectFile = path.join(projectRoot, PROJECT_FILE_PATH);
+        result.push(...await readBridgesFile(projectFile, 'file'));
+    }
+    return result;
+}
+/* ===================================================================
+ * Source 4 -- env vars
+ * ================================================================ */
+function discoverFromEnv() {
+    const raw = process.env.YUJIN_MCP_BRIDGES;
+    if (!raw)
+        return [];
+    /* Format: "id1:url1,id2:url2,id3:url3" */
+    const parts = raw.split(',').map((s) => s.trim()).filter(Boolean);
+    const out = [];
+    for (const part of parts) {
+        const colon = part.indexOf(':');
+        if (colon <= 0)
+            continue;
+        const id = part.slice(0, colon).trim();
+        const endpoint = part.slice(colon + 1).trim();
+        if (!id || !endpoint)
+            continue;
+        out.push({
+            id,
+            endpoint,
+            source: 'env',
+            enabled: true,
+        });
+    }
+    return out;
+}
+/* ===================================================================
+ * Dedup + cap
+ * ================================================================ */
+/** Precedence when an id appears in multiple sources:
+ *  env > manifest > file > loopback. Higher-precedence wins. */
+const SOURCE_RANK = {
+    env: 4, manifest: 3, file: 2, loopback: 1,
+};
+function dedupePreservePrecedence(bridges) {
+    const byId = new Map();
+    for (const b of bridges) {
+        const existing = byId.get(b.id);
+        if (!existing || SOURCE_RANK[b.source] > SOURCE_RANK[existing.source]) {
+            byId.set(b.id, b);
+        }
+    }
+    return Array.from(byId.values());
+}
+/* ===================================================================
+ * Public API
+ * ================================================================ */
+/** Run all 4 discovery sources in parallel + dedupe + cap +
+ *  merge the persistent enabled-state from F101 slice 5
+ *  sub-slice 1 (~/.yujin-forge/mcp-state.json). A bridge marked
+ *  disabled in state surfaces with enabled:false; downstream
+ *  consumers (manifest stub, invoke-tool) filter accordingly. */
+export async function discoverBridges(opts = {}) {
+    const ports = opts.loopbackPorts ?? DEFAULT_PORTS;
+    const timeoutMs = opts.loopbackTimeoutMs ?? 200;
+    const maxActive = opts.maxActive ?? 10;
+    const [loopback, manifest, files, env, state] = await Promise.all([
+        discoverFromLoopback(ports, timeoutMs),
+        opts.projectRoot ? discoverFromManifest(opts.projectRoot) : Promise.resolve([]),
+        discoverFromFiles(opts.projectRoot),
+        Promise.resolve(discoverFromEnv()),
+        import('./state.js').then((m) => m.readState()).catch(() => ({ version: 1, bridges: {} })),
+    ]);
+    const all = [...loopback, ...manifest, ...files, ...env];
+    const dedup = dedupePreservePrecedence(all);
+    /* Apply persisted enabled-state. Default true when the bridge
+     * has no entry yet. */
+    for (const b of dedup) {
+        const entry = state.bridges[b.id];
+        if (entry && entry.enabled === false)
+            b.enabled = false;
+    }
+    /* Sort: enabled first, then by source rank (env first), then by id. */
+    dedup.sort((a, b) => {
+        if (a.enabled !== b.enabled)
+            return a.enabled ? -1 : 1;
+        if (a.source !== b.source)
+            return SOURCE_RANK[b.source] - SOURCE_RANK[a.source];
+        return a.id.localeCompare(b.id);
+    });
+    /* Cap. */
+    return dedup.slice(0, maxActive);
+}
+/** Singleton accessor with simple per-process cache (60s).
+ *  Recomputed when `refresh: true` passed. */
+let _cache = null;
+const CACHE_TTL_MS = 60 * 1000;
+export async function getActiveBridges(opts = {}) {
+    if (!opts.refresh && _cache && Date.now() - _cache.at < CACHE_TTL_MS) {
+        return _cache.bridges;
+    }
+    const bridges = await discoverBridges(opts);
+    _cache = { bridges, at: Date.now() };
+    return bridges;
+}
+/** Clear the cache (used in tests + by yf mcp scan). */
+export function resetBridgeCache() {
+    _cache = null;
+}
+export const _internal = { dedupePreservePrecedence, SOURCE_RANK };
+//# sourceMappingURL=bridge_registry.js.map

package/dist/mcp/bridge_registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge_registry.js","sourceRoot":"","sources":["../../src/mcp/bridge_registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAyClC,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAErG,MAAM,aAAa,GAAI,cAAc,CAAC;AACtC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAE1D;;sEAEsE;AAEtE,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAiB;IAC9D,MAAM,GAAG,GAAG,mBAAmB,GAAG,IAAI,GAAG,kBAAkB,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAA0C,CAAC;QACvF;kEAC0D;QAC1D,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QACjF,OAAO;YACL,EAAE;YACF,QAAQ,EAAE,mBAAmB,GAAG,IAAI;YACpC,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,IAAI,EAAE,IAAI;SACzB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAe,EAAE,SAAiB;IACpE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC3D,CAAC;AAUD,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IACrD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC,WAAW;aACpB,MAAM,CAAC,CAAC,CAAC,EAAgE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;aACvI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,UAAmB;YAC3B,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAC,CAAC,CAAC;IACR,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAiBD,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,MAAc;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC,OAAO;aAChB,MAAM,CAAC,CAAC,CAAC,EAAmF,EAAE,CAC7F,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;aAC5D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK;YAC5B,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAC,CAAC,CAAC;IACR,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,WAAoB;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;IACrE,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;sEAEsE;AAEtE,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,0CAA0C;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ;YAAE,SAAS;QAC/B,GAAG,CAAC,IAAI,CAAC;YACP,EAAE;YACF,QAAQ;YACR,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;sEAEsE;AAEtE;gEACgE;AAChE,MAAM,WAAW,GAAwC;IACvD,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC1C,CAAC;AAEF,SAAS,wBAAwB,CAAC,OAAoB;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;sEAEsE;AAEtE;;;;iEAIiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAyB,EAAE;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,aAAa,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,GAAG,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IAEvC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChE,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC;QACtC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAiB,CAAC;QAC9F,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAA8D,EAAE,CAAC,CAAC;KACvJ,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC5C;2BACuB;IACvB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;YAAE,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC;IAC1D,CAAC;IACD,uEAAuE;IACvE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IACH,UAAU;IACV,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;8CAC8C;AAC9C,IAAI,MAAM,GAAgD,IAAI,CAAC;AAC/D,MAAM,YAAY,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAiD,EAAE;IACxF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,wBAAwB,EAAE,WAAW,EAAE,CAAC"}

package/dist/mcp/config.d.ts

@@ -0,0 +1,25 @@
+export interface McpConfig {
+    enabled: boolean;
+    bridges_path: string;
+    discover_default_limit: number;
+    transient_tools_ttl_turns: number;
+    max_concurrent_servers: number;
+}
+declare function configPath(): string;
+declare function defaultBridgesPath(): string;
+/** Read the MCP section + apply defaults. */
+export declare function readMcpConfig(): Promise<McpConfig>;
+/** Patch the mcp section. Other top-level keys preserved. */
+export declare function patchMcpConfig(patch: Partial<McpConfig>): Promise<McpConfig>;
+/** Convenience: am I allowed to do MCP work? Default false.
+ *  Honours the env override YF_MCP_DISABLED=1 even when config
+ *  says enabled (kill-switch for incident response). */
+export declare function mcpEnabled(): Promise<boolean>;
+export declare function mcpEnabledSync(): boolean;
+export declare function primeSyncCache(): Promise<void>;
+export declare const _internal: {
+    configPath: typeof configPath;
+    defaultBridgesPath: typeof defaultBridgesPath;
+};
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/mcp/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/mcp/config.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,SAAS;IACxB,OAAO,EAAoB,OAAO,CAAC;IACnC,YAAY,EAAe,MAAM,CAAC;IAClC,sBAAsB,EAAK,MAAM,CAAC;IAClC,yBAAyB,EAAE,MAAM,CAAC;IAClC,sBAAsB,EAAK,MAAM,CAAC;CACnC;AAeD,iBAAS,UAAU,IAAI,MAAM,CAE5B;AAED,iBAAS,kBAAkB,IAAI,MAAM,CAEpC;AAqBD,6CAA6C;AAC7C,wBAAsB,aAAa,IAAI,OAAO,CAAC,SAAS,CAAC,CAkBxD;AAED,6DAA6D;AAC7D,wBAAsB,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAOlF;AAED;;wDAEwD;AACxD,wBAAsB,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAKnD;AAMD,wBAAgB,cAAc,IAAI,OAAO,CAIxC;AACD,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAEpD;AAGD,eAAO,MAAM,SAAS;;;CAAqC,CAAC"}

package/dist/mcp/config.js

@@ -0,0 +1,116 @@
+/**
+ * MCP feature flag config (alpha.59p.3).
+ *
+ * Per Pablo's directive 2026-06-02: "Quiero que la parte MCP sea
+ * activable/desactivable por configuracion." Default OFF. Until
+ * the user runs `yf mcp enable`, NO MCP code path activates --
+ * no subprocesses spawned, no stubs in the manifest, no endpoints
+ * exposed.
+ *
+ * Storage: $YF_CONFIG_DIR/config.json
+ *   {
+ *     "mcp": {
+ *       "enabled": false,
+ *       "bridges_path": "~/.yujin-forge/mcp_bridges.json",
+ *       "discover_default_limit": 5,
+ *       "transient_tools_ttl_turns": 5,
+ *       "max_concurrent_servers": 8
+ *     }
+ *   }
+ *
+ * Spec: docs/MCP_BRIDGE_PLAN.md (v2) sec 3.3.
+ * ASCII-only.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+const DEFAULT = {
+    enabled: false,
+    bridges_path: '', // resolved at read time
+    discover_default_limit: 5,
+    transient_tools_ttl_turns: 5,
+    max_concurrent_servers: 8,
+};
+function configDir() {
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    return process.env.YF_CONFIG_DIR || path.join(home, '.yujin-forge');
+}
+function configPath() {
+    return path.join(configDir(), 'config.json');
+}
+function defaultBridgesPath() {
+    return path.join(configDir(), 'mcp_bridges.json');
+}
+/** Read the whole config.json. Returns {} when missing or
+ *  malformed (never throws). */
+async function readWholeConfig() {
+    try {
+        const raw = await fs.readFile(configPath(), 'utf-8');
+        const j = JSON.parse(raw);
+        return (j && typeof j === 'object') ? j : {};
+    }
+    catch {
+        return {};
+    }
+}
+async function writeWholeConfig(obj) {
+    await fs.mkdir(configDir(), { recursive: true });
+    const tmp = configPath() + '.tmp';
+    await fs.writeFile(tmp, JSON.stringify(obj, null, 2), 'utf-8');
+    await fs.rename(tmp, configPath());
+}
+/** Read the MCP section + apply defaults. */
+export async function readMcpConfig() {
+    const whole = await readWholeConfig();
+    const raw = (whole.mcp && typeof whole.mcp === 'object') ? whole.mcp : {};
+    return {
+        enabled: raw.enabled === true,
+        bridges_path: (typeof raw.bridges_path === 'string' && raw.bridges_path)
+            ? String(raw.bridges_path)
+            : defaultBridgesPath(),
+        discover_default_limit: typeof raw.discover_default_limit === 'number' && raw.discover_default_limit > 0
+            ? raw.discover_default_limit
+            : DEFAULT.discover_default_limit,
+        transient_tools_ttl_turns: typeof raw.transient_tools_ttl_turns === 'number' && raw.transient_tools_ttl_turns >= 0
+            ? raw.transient_tools_ttl_turns
+            : DEFAULT.transient_tools_ttl_turns,
+        max_concurrent_servers: typeof raw.max_concurrent_servers === 'number' && raw.max_concurrent_servers > 0
+            ? raw.max_concurrent_servers
+            : DEFAULT.max_concurrent_servers,
+    };
+}
+/** Patch the mcp section. Other top-level keys preserved. */
+export async function patchMcpConfig(patch) {
+    const whole = await readWholeConfig();
+    const current = await readMcpConfig();
+    const next = { ...current, ...patch };
+    whole.mcp = next;
+    await writeWholeConfig(whole);
+    return next;
+}
+/** Convenience: am I allowed to do MCP work? Default false.
+ *  Honours the env override YF_MCP_DISABLED=1 even when config
+ *  says enabled (kill-switch for incident response). */
+export async function mcpEnabled() {
+    const envOff = process.env.YF_MCP_DISABLED;
+    if (envOff === '1' || envOff === 'true' || envOff === 'yes')
+        return false;
+    const cfg = await readMcpConfig();
+    return cfg.enabled === true;
+}
+/** Synchronous variant for paths that cannot async (e.g. system
+ *  prompt assembly that already has the config loaded). Reads
+ *  cached value if available, else returns false. */
+let _cachedEnabled = null;
+export function mcpEnabledSync() {
+    const envOff = process.env.YF_MCP_DISABLED;
+    if (envOff === '1' || envOff === 'true' || envOff === 'yes')
+        return false;
+    return _cachedEnabled === true;
+}
+export async function primeSyncCache() {
+    _cachedEnabled = await mcpEnabled();
+}
+/* Test seam. */
+export const _internal = { configPath, defaultBridgesPath };
+//# sourceMappingURL=config.js.map

package/dist/mcp/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/mcp/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAUzB,MAAM,OAAO,GAAc;IACzB,OAAO,EAAoB,KAAK;IAChC,YAAY,EAAe,EAAE,EAAG,wBAAwB;IACxD,sBAAsB,EAAK,CAAC;IAC5B,yBAAyB,EAAE,CAAC;IAC5B,sBAAsB,EAAK,CAAC;CAC7B,CAAC;AAEF,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACpD,CAAC;AAED;gCACgC;AAChC,KAAK,UAAU,eAAe;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAA4B;IAC1D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,6CAA6C;AAC7C,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAA8B,CAAC,CAAC,CAAC,EAAE,CAAC;IACrG,OAAO;QACL,OAAO,EAAoB,GAAG,CAAC,OAAO,KAAK,IAAI;QAC/C,YAAY,EAAe,CAAC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC;YACxD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YAC1B,CAAC,CAAC,kBAAkB,EAAE;QACnD,sBAAsB,EAAK,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ,IAAI,GAAG,CAAC,sBAAsB,GAAG,CAAC;YAC9E,CAAC,CAAC,GAAG,CAAC,sBAAsB;YAC5B,CAAC,CAAC,OAAO,CAAC,sBAAsB;QAC7D,yBAAyB,EAAE,OAAO,GAAG,CAAC,yBAAyB,KAAK,QAAQ,IAAI,GAAG,CAAC,yBAAyB,IAAI,CAAC;YACrF,CAAC,CAAC,GAAG,CAAC,yBAAyB;YAC/B,CAAC,CAAC,OAAO,CAAC,yBAAyB;QAChE,sBAAsB,EAAK,OAAO,GAAG,CAAC,sBAAsB,KAAK,QAAQ,IAAI,GAAG,CAAC,sBAAsB,GAAG,CAAC;YAC9E,CAAC,CAAC,GAAG,CAAC,sBAAsB;YAC5B,CAAC,CAAC,OAAO,CAAC,sBAAsB;KAC9D,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAyB;IAC5D,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,MAAM,IAAI,GAAc,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IACjD,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;IACjB,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;wDAEwD;AACxD,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC;AAC9B,CAAC;AAED;;qDAEqD;AACrD,IAAI,cAAc,GAAmB,IAAI,CAAC;AAC1C,MAAM,UAAU,cAAc;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC1E,OAAO,cAAc,KAAK,IAAI,CAAC;AACjC,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,cAAc,GAAG,MAAM,UAAU,EAAE,CAAC;AACtC,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC"}