@octane-xplat/mcp 0.1.0 → 0.16.0

package/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Alec Larson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -1,3 +1,344 @@
 # @octane-xplat/mcp
 
-Bootstrap placeholder for automated publishing. This version has no supported API.
+MCP server for agents working on Octane Xplat consumer apps. One entry point
+gives the agent detected project identity, framework versions, guidance,
+capability discovery, and the shared permission / session / evidence contracts
+that every later subsystem (docs, code search, runtime, inspection,
+development actions) plugs into.
+
+Published as a normal lockstep package on npm. The qualified surface today is
+the Chromium consumer lane (status/docs/code/build/launch/inspection/
+interaction/development actions); native-platform inspection and input
+adapters report honest `unavailable` results until they are qualified — see
+[Remaining acceptance](#remaining-acceptance).
+
+## Install and run
+
+Add the server to a consumer app and point the agent's MCP client at the
+installed `xplat-mcp` bin:
+
+```sh
+pnpm add -D @octane-xplat/mcp
+```
+
+```json
+{
+	"mcpServers": {
+		"octane-xplat": {
+			"command": "xplat-mcp",
+			"args": ["--workspace", "/path/to/app-workspace"]
+		}
+	}
+}
+```
+
+A one-off run without a devDependency also works:
+
+```sh
+pnpm dlx @octane-xplat/mcp --workspace /path/to/app-workspace
+```
+
+For development inside this repository — `start` runs the TypeScript source
+directly (Node ≥22.18 strips types); `test` and `prepack` run `vite build` so
+the checked and packed surface is the emitted `dist/`:
+
+```sh
+pnpm --filter @octane-xplat/mcp start -- --workspace <path>
+pnpm --filter @octane-xplat/mcp test
+```
+
+Transport is stdio; stdout is protocol-clean (diagnostics go to stderr).
+Options: `--workspace` / `XPLAT_MCP_WORKSPACE` (default cwd), `--app` /
+`XPLAT_MCP_APP` (pre-select an app id), `--permissions` /
+`XPLAT_MCP_PERMISSIONS` (comma-separated scope grants), `--evidence-dir` /
+`XPLAT_MCP_EVIDENCE_DIR`.
+
+## Tools
+
+| Tool                                    | Purpose                                                                                                                                                                                                        |
+| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `xplat_project_status`                  | Detected apps, selection state, framework version binding, guidance sources, docs/code-index status, declared platforms, runtime prerequisites, capability summary, permissions, boundaries, next steps.       |
+| `xplat_select_app`                      | Explicitly bind an app by id/path/name. Ambiguous or unknown selections fail with the candidate list — the server never picks silently.                                                                        |
+| `xplat_capability_matrix`               | Per-platform capability entries: build, launch, logs, inspection, screenshot, interaction, and the rest are separate rows with status, detail, and alternatives.                                               |
+| `xplat_permissions`                     | Grant states per scope plus the action-time check result and recovery path.                                                                                                                                    |
+| `xplat_sessions`                        | Bound sessions: owned vs attached user-owned, state, build identity.                                                                                                                                           |
+| `xplat_targets`                         | Launchable targets per platform (simulators, devices, host targets) with availability, missing-toolchain reasons, and busy/ownership state.                                                                    |
+| `xplat_build`                           | Build the bound app for one platform as a job — same commands `xplat build` runs. `requestKey` dedupes retries.                                                                                                |
+| `xplat_launch`                          | Owned dev session on one target as a job; completes at confirmed readiness, session owns the processes until `xplat_session_end`.                                                                              |
+| `xplat_attach`                          | Bind a compatible already-running dev session (user-owned, preserved).                                                                                                                                         |
+| `xplat_logs`                            | Bounded ordered logs for a session or build job: cursor, limit, stream filter, truncation/reset indicators, `historical` flag for dead sessions.                                                               |
+| `xplat_dev_actions`                     | The bound app's live development-action registry: instance identity, revision, declarations (contracts, effects, availability). Empty vs disconnected vs no-bridge are distinct states.                        |
+| `xplat_dev_action_invoke`               | Invoke an action against an exact app instance + registry revision. Pre-validates input, availability, grants and queue bounds; returns a job (`requestKey` dedupes retries).                                  |
+| `xplat_dev_action_status`               | Invocation status/result — same job data restricted to dev-action jobs, with instance/request identity.                                                                                                        |
+| `xplat_job_status` / `xplat_job_cancel` | Bounded job status and cooperative cancellation.                                                                                                                                                               |
+| `xplat_session_end`                     | Ownership-safe cleanup: owned sessions release resources; attached sessions are preserved (our log taps still stop).                                                                                           |
+| `xplat_evidence`                        | `list` / `retain` / `delete` evidence; retain takes an optional ISO expiration.                                                                                                                                |
+| `xplat_code_search`                     | Exact identifier/token search over current source (`mode: 'exact'`), optional local semantic index (`mode: 'semantic'`), or both (`'auto'`). Corpus filters: `app`, `framework`; platform and package filters. |
+| `xplat_code_read`                       | Bounded read of current source by search ref (`xplat-code://…`) or explicit corpus + path; results carry freshness markers and continuation offsets.                                                           |
+| `xplat_docs_search` / `xplat_docs_read` | Installed-version docs search and bounded page reads, with snapshot/version provenance and unavailable/conflict results.                                                                                       |
+| `xplat_guidance`                        | Tailored guidance for the selected app's installed packages.                                                                                                                                                   |
+
+## Retrieve the app's documentation
+
+Select your app first. Search defaults to maintained guides for its actual
+installed versions; design notes and recipes require an explicit corpus.
+The provider validates release tags and preserves cached snapshot commits.
+Missing matching docs return an installed-source fallback instead of latest docs.
+
+```json
+{
+	"name": "xplat_docs_search",
+	"arguments": { "query": "testID", "package": "@octane-xplat/ui", "platform": "web" }
+}
+```
+
+Read a result using its `ref`. A ref from an older installation remains tied
+to that version and is labeled outside the installed binding after an upgrade.
+`xplat_project_status` reports provider readiness; each search reports actual
+snapshot availability, so readiness alone is not a successful retrieval.
+
+```json
+{
+	"name": "xplat_docs_read",
+	"arguments": {
+		"package": "@octane-xplat/ui",
+		"path": "docs/verify/test-identifiers.md",
+		"limit": 2000
+	}
+}
+```
+
+Code search reads the bound application's source plus its installed
+`@octane-xplat/*` package sources — corpora stay labeled and distinguishable.
+The semantic index is local TF-IDF (`local-tfidf`): it builds in the
+background, reports `preparing` / `ready` / `stale` / `unavailable`, and stale
+hits are revalidated against current file content before serving. Nothing
+leaves the machine; there is no remote embedding path. Secrets, private
+configuration, generated output, and paths outside the bound scope are
+excluded and unreadable.
+
+Every result is `{ ok: true, data } | { ok: false, error }` where `error` is a
+`ContractError` from the shared vocabulary.
+
+The service layer lives in `packages/cli/src/mcp/` — the `xplat` CLI projects
+the same contracts through its agent commands (`xplat catalog --json` is the
+entry point). `packages/mcp/src/` holds the stdio transport adapter: tool
+registration wraps the shared services, and the published `.d.ts` contract
+surface stays here under `types/contracts/`. Sources are TypeScript; `pnpm
+build` emits the runnable ESM to `dist/` (`pnpm test` builds first).
+
+## Contract surface (`@octane-xplat/mcp/contracts/*`)
+
+Later work packages integrate against these modules; the `.d.ts` files under
+`types/contracts/` are the documented surface and the compiled `dist/` modules
+carry the runtime values and stores (re-exported from `@octane-xplat/cli`).
+
+- `errors` — `ContractErrorCode` vocabulary (`invalid_selection`,
+  `ambiguous_selection`, `permission_denied`, `unsupported_capability`,
+  `prerequisite_missing`, `target_busy`, `stale_identity`,
+  `disconnected_runtime`, `execution_failure`, `not_found`, `cancelled`,
+  `timeout`, `unavailable`) with `recovery` (smallest corrective action) and
+  `retryable` semantics.
+- `identity` — `Platform`, `AppRef`, `FrameworkBinding` (installed / workspace /
+  lockfile / provisional version sources), `GuidanceStatus`,
+  `RuntimePrerequisite`, `AppSelection` (`bound` / `ambiguous` / `none`).
+- `capabilities` — `CapabilityId`, `CapabilityStatus`, `CapabilityEntry`,
+  `PlatformCapabilityMatrix`, and the `CapabilityProvider` / registry seam
+  adapters use to report real support.
+- `policy` — `PermissionScope` grants (`workspace`, `runtime-actions`,
+  `visual-capture`, `evidence-retain`, `external-effects`), `PolicyStore` with
+  task-authorization baseline, action-time checks, expiry, revocation, and an
+  elicitation channel for explicit developer grants. `visual-capture` is never
+  baseline-granted.
+- `sessions` — `SessionBinding` (`owned` / `attached`, `starting` / `ready` /
+  `disconnected` / `stopped`), `Job` (`queued` → `running` → terminal, with
+  `cancelling` / `cancelled`), request-key deduplication, and ownership-safe
+  `end` / `shutdown`.
+- `evidence` — `EvidenceRecord` with provenance (app, platform, target,
+  session, build identity, time, interaction mechanism), session-scoped
+  default retention, `retain` with expiration, ownership-safe deletion, and
+  `TRANSCRIPT_LIMITATION_NOTE`. `isOsInputEvidence` is the guard that keeps
+  handler-dispatch results from being labeled OS-input verification.
+- `status` — `ProjectStatusReport`, the shape `xplat_project_status` returns.
+- `code` — the `CodeProvider` seam the context's `code` slot consumes, plus
+  `CodeHit` / `CodeSearchResult` / provenance and freshness shapes.
+- `boundaries` — `PRODUCT_BOUNDARIES`, the advertised out-of-scope list.
+- `actions` — the app-declared development-action wire contract (package G):
+  `DevActionDeclaration` (stable id, title, description, runtime-validatable
+  input/result field contracts, disclosed effects, availability, execution
+  policy), `DevActionRegistryAnnouncement` (instance identity + revision +
+  declarations), invocation request/outcome types, and the field-subset
+  validators both sides share. The app announces its registry through a
+  dev-bridge (`xplatDevBridge` vite middleware in `@octane-xplat/cli`, included
+  in the `xplatNative` preset); the server scans the app's bridge session
+  files under `node_modules/.cache/xplat/dev-bridge/` and polls live
+  announcements — an empty registry is never confused with a disconnected app.
+
+## Runtime (work item D)
+
+The shared `runtime/` service (in `packages/cli/src/mcp/runtime/`, re-exported
+here) implements build/launch/attach/logs/cleanup for consumer apps
+on all six platforms. Adapters (`runtime/adapters/*`) own platform
+mechanics and always spawn the app's own toolchain — `pnpm exec vite`,
+`pnpm exec ns run …`, the app's installed `@octane-xplat/cli` dev entry, or
+its `dev` script — so a session behaves like the app's installed framework
+version. The shared `runtime/service` module owns the contract behavior: explicit
+app+target binding, `target_busy` contention, job dedupe/cooperative
+cancel, ownership-safe cleanup, bounded logs, and capability-matrix entries.
+
+| Platform       | Launch                                                            | Attach                                             | Host gate  |
+| -------------- | ----------------------------------------------------------------- | -------------------------------------------------- | ---------- |
+| web / Chromium | `pnpm exec vite` + headless Chromium (devtools endpoint reported) | probe common dev ports — identity heuristic        | none       |
+| iOS            | `ns run ios --device <udid>`                                      | booted sim + app running → `simctl log stream` tap | macOS      |
+| Android        | `ns run android --device <serial>`                                | package running → `adb logcat --pid` tap           | none (adb) |
+| macOS          | `xplat.targets.macos.dev` → CLI dev entry, else `pnpm run dev`    | pgrep on app root — no scrollback                  | macOS      |
+| Linux          | `pnpm run dev` (app-owned script)                                 | pgrep on app root                                  | Linux      |
+| Windows        | `ns run windows`                                                  | not yet qualified                                  | Windows    |
+
+Readiness is probe/marker-confirmed (`ready` session state) — HTTP 200 for
+web, the host-start marker for macOS, `Successfully synced application` /
+first `CONSOLE` line for `ns run`. A timeout or pre-ready exit fails the job
+and ends the owned session honestly. Chromium is located via
+`XPLAT_MCP_CHROMIUM`, the Playwright browser cache, or system installs;
+without it the web session still reports the server URL with an explicit
+`browser.launched: false`.
+
+Physical iOS devices, Windows attach detection, and non-simulator iOS log
+taps are reported limitations, not silent gaps — the capability matrix
+carries the detail and an alternative.
+
+## Inspect and interact with Chromium
+
+This development package adds `xplat_inspect`, `xplat_interact`, and
+`xplat_screenshot` for the Chromium browser started by `xplat_launch`.
+Select a DOM `id` or shared `testID` explicitly; duplicate names fail.
+Inspection returns bounded text/value/geometry, a document identity, and
+session/build provenance. Main-document DOM hosts are the qualified surface;
+shadow roots, frames, component ownership and signals are excluded.
+
+```json
+{
+	"name": "xplat_inspect",
+	"arguments": {
+		"sessionId": "SESSION_FROM_LAUNCH",
+		"control": { "kind": "testID", "name": "counter.increment" }
+	}
+}
+```
+
+Pass the returned `documentId` when interacting. A `dom-event` interaction
+clicks the control center through CDP. `os-input` sends Space or Enter through
+the macOS event system to the owned headed Chromium process. It requires
+Swift, OS event-posting permission, and a desktop-input reservation. The
+server does not open permission prompts. Inspect the resulting app state
+separately; sending input alone is not an assertion.
+
+```json
+{
+	"name": "xplat_interact",
+	"arguments": {
+		"sessionId": "SESSION_FROM_LAUNCH",
+		"documentId": "DOCUMENT_FROM_INSPECTION",
+		"control": { "kind": "testID", "name": "counter.increment" },
+		"mechanism": "os-input",
+		"key": "Space"
+	}
+}
+```
+
+Screenshot requests require an explicit current-task `visual-capture` grant
+before connecting or sending a capture command. No grant means no capture.
+Password fields, hidden inputs and hosts marked `data-xplat-private` are
+redacted in nonvisual inspection; this does not guarantee complete redaction
+of arbitrary application data.
+
+```json
+{ "name": "xplat_screenshot", "arguments": { "sessionId": "SESSION_FROM_LAUNCH" } }
+```
+
+## Run the consumer acceptance lane
+
+Use a fresh directory outside your existing app. These commands scaffold the
+normal web starter and add one app-owned development action. The in-repo lane
+links framework packages to this checkout; other dependencies
+install normally. The runner checks docs and current code, build/readiness,
+the counter's `0 → 1` transition, action discovery/invocation, screenshot
+denial, logs, and owned browser/server/profile cleanup. It also checks that
+the fixture declaration and handler are absent from production artifacts.
+
+```sh
+node packages/mcp/tests/prepare-consumer.mjs /tmp/new-xplat-mcp-app
+pnpm --dir /tmp/new-xplat-mcp-app install
+node packages/mcp/tests/consumer-workflow.mjs /tmp/new-xplat-mcp-app
+```
+
+The default run supplies browser-event evidence. On macOS, reserve the full
+resource set and add `--os-input` for a headed Chromium OS keyboard journey.
+Only the owned browser receives the events; the helper attempts to restore the
+previously active application and reports when restoration is unconfirmed.
+The runner captures no images.
+
+```sh
+goddard-agent resource run --json '{"resources":{"native_builds":1,"desktop_input":1},"purpose":"MCP consumer OS keyboard acceptance"}' -- node packages/mcp/tests/consumer-workflow.mjs /tmp/new-xplat-mcp-app --os-input
+```
+
+The packed-artifact lane qualifies the same checks against release-evidence
+packaging: `prepare-packed-consumer.mjs` packs the needed packages, scaffolds
+through the packed `create-octane-xplat` bin, installs `file:` tarballs (no
+registry/latest resolution for framework packages), and tags the framework
+HEAD as `v<installed version>` in a local bare release fixture. The runner
+spawns the consumer's own installed `xplat-mcp` bin over stdin/stdout and
+redirects the canonical release-repo URL to the fixture through a per-process
+`url.insteadOf` (never user git config). Snapshot cache and evidence roots are
+isolated under the work dir. OS keyboard input additionally requires an
+unlocked console — the window server refuses activation while the screen is
+locked, and the run reports that block honestly.
+
+```sh
+goddard-agent resource run --json '{"resources":{"native_builds":1,"desktop_input":1},"purpose":"packed MCP stdio consumer acceptance"}' -- bash -c '
+  node packages/mcp/tests/prepare-packed-consumer.mjs /tmp/xplat-packed-mcp &&
+  node packages/mcp/tests/packed-stdio-consumer.mjs /tmp/xplat-packed-mcp'
+```
+
+For an existing consumer, declare actions behind the development build gate.
+Registration automatically starts the bridge when the dev-server endpoint is
+present. The action's contracts and effects appear in `xplat_dev_actions`;
+no action-specific MCP tool definition is needed.
+
+```ts
+if (import.meta.env.DEV) {
+	const { registerDevAction } = await import('@octane-xplat/platform/dev-actions')
+	registerDevAction({
+		id: 'fixture.describe-counter',
+		title: 'Describe the counter',
+		description: 'Identify this test fixture without external effects.',
+		result: { fields: { label: { type: 'string' } } },
+		effects: { summary: 'Read fixture identity.' },
+		run: () => ({ label: 'starter-counter' }),
+	})
+}
+```
+
+## Remaining acceptance
+
+The Chromium lane is an incremental milestone. All six platforms remain
+required by the original plan. Native inspection/input adapters, attached
+Chromium inspection, approved screenshot qualification, and the complete
+platform-by-capability acceptance matrix remain unfinished. Runtime adapters
+and honest unavailable responses do not establish native behavior.
+
+| Target          | Inspection/input qualification boundary                                        |
+| --------------- | ------------------------------------------------------------------------------ |
+| Chromium        | Owned main-document DOM; browser events plus macOS scoped OS keyboard path     |
+| iOS / Android   | Native host inspection and OS-input adapters still required                    |
+| macOS           | AppKit host inspection/input still required; Chromium on macOS is web evidence |
+| Linux / Windows | Target-host adapters and independent consumer qualification still required     |
+
+## Boundaries
+
+This server complements the agent's editing tools. It is not an autonomous
+code editor or deployment system: no arbitrary shell execution, no arbitrary
+runtime expression evaluation, no universal component tree, no hook/signal
+inspection, no profiling API, no cloud indexing by default, no app-store
+operations, no credential management. Screenshots are permission-gated —
+capability existence never implies capture approval.

package/dist/_virtual/_rolldown/runtime.js

@@ -0,0 +1,27 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+//#endregion
+export { __exportAll, __reExport };

package/dist/actions/bridge.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/actions/bridge";

package/dist/contracts/actions.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/contracts/actions";

package/dist/contracts/boundaries.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/contracts/boundaries";

package/dist/contracts/capabilities.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/contracts/capabilities";

package/dist/contracts/code.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/contracts/code";

package/dist/contracts/errors.js

@@ -0,0 +1,8 @@
+import { __exportAll, __reExport } from "../_virtual/_rolldown/runtime.js";
+export * from "@octane-xplat/cli/mcp/contracts/errors";
+//#region src/contracts/errors.ts
+var errors_exports = /* @__PURE__ */ __exportAll({});
+import * as import__octane_xplat_cli_mcp_contracts_errors from "@octane-xplat/cli/mcp/contracts/errors";
+__reExport(errors_exports, import__octane_xplat_cli_mcp_contracts_errors);
+//#endregion
+export { errors_exports };

package/dist/contracts/evidence.js

@@ -0,0 +1,8 @@
+import { __exportAll, __reExport } from "../_virtual/_rolldown/runtime.js";
+export * from "@octane-xplat/cli/mcp/contracts/evidence";
+//#region src/contracts/evidence.ts
+var evidence_exports = /* @__PURE__ */ __exportAll({});
+import * as import__octane_xplat_cli_mcp_contracts_evidence from "@octane-xplat/cli/mcp/contracts/evidence";
+__reExport(evidence_exports, import__octane_xplat_cli_mcp_contracts_evidence);
+//#endregion
+export { evidence_exports };

package/dist/contracts/identity.js

@@ -0,0 +1,8 @@
+import { __exportAll, __reExport } from "../_virtual/_rolldown/runtime.js";
+export * from "@octane-xplat/cli/mcp/contracts/identity";
+//#region src/contracts/identity.ts
+var identity_exports = /* @__PURE__ */ __exportAll({});
+import * as import__octane_xplat_cli_mcp_contracts_identity from "@octane-xplat/cli/mcp/contracts/identity";
+__reExport(identity_exports, import__octane_xplat_cli_mcp_contracts_identity);
+//#endregion
+export { identity_exports };

package/dist/contracts/index.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/contracts/index";

package/dist/contracts/inspection.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/contracts/inspection";

package/dist/contracts/policy.js

@@ -0,0 +1,8 @@
+import { __exportAll, __reExport } from "../_virtual/_rolldown/runtime.js";
+export * from "@octane-xplat/cli/mcp/contracts/policy";
+//#region src/contracts/policy.ts
+var policy_exports = /* @__PURE__ */ __exportAll({});
+import * as import__octane_xplat_cli_mcp_contracts_policy from "@octane-xplat/cli/mcp/contracts/policy";
+__reExport(policy_exports, import__octane_xplat_cli_mcp_contracts_policy);
+//#endregion
+export { policy_exports };

package/dist/contracts/sessions.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/contracts/sessions";

package/dist/contracts/status.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/contracts/status";

package/dist/discovery.js

@@ -0,0 +1,8 @@
+import { __exportAll, __reExport } from "./_virtual/_rolldown/runtime.js";
+export * from "@octane-xplat/cli/mcp/discovery";
+//#region src/discovery.ts
+var discovery_exports = /* @__PURE__ */ __exportAll({});
+import * as import__octane_xplat_cli_mcp_discovery from "@octane-xplat/cli/mcp/discovery";
+__reExport(discovery_exports, import__octane_xplat_cli_mcp_discovery);
+//#endregion
+export { discovery_exports };

package/dist/docs.js

@@ -0,0 +1,63 @@
+import { errors_exports } from "./contracts/errors.js";
+import { identity_exports } from "./contracts/identity.js";
+import { status_exports } from "./status.js";
+import { z } from "zod";
+//#region src/docs.ts
+function registerDocsTools(server, context, respond) {
+	const run = (method) => async (args) => {
+		const permission = context.policy.require("workspace");
+		if (!permission.granted) return respond({
+			ok: false,
+			error: permission.error
+		});
+		const selection = (0, status_exports.resolveSelection)(context);
+		if (selection.state !== "bound") return respond({
+			ok: false,
+			error: (0, errors_exports.contractError)(selection.state === "ambiguous" ? "ambiguous_selection" : "invalid_selection", "Bind an app with xplat_select_app before retrieving docs.")
+		});
+		try {
+			return respond({
+				ok: true,
+				data: await context.docs.serviceFor(selection.app)[method](args)
+			});
+		} catch (error) {
+			return respond({
+				ok: false,
+				error: (0, errors_exports.toContractError)(error)
+			});
+		}
+	};
+	server.registerTool("xplat_docs_search", {
+		description: "Search the selected app’s installed-version docs. Results include version/snapshot provenance, unavailable packages, conflicts, and separately labeled project guidance.",
+		inputSchema: {
+			query: z.string().trim().min(1).max(500),
+			package: z.string().optional(),
+			version: z.string().optional().describe("Explicit comparison version, visibly outside the installed binding."),
+			platform: z.enum(identity_exports.PLATFORMS).optional(),
+			corpus: z.enum([
+				"guide",
+				"recipe",
+				"design-note",
+				"implementation-note"
+			]).optional().default("guide"),
+			limit: z.number().int().min(1).max(50).optional()
+		}
+	}, run("search"));
+	server.registerTool("xplat_docs_read", {
+		description: "Read a bounded documentation page from a search ref, or package and path, preserving its version binding.",
+		inputSchema: {
+			ref: z.string().optional(),
+			package: z.string().optional(),
+			path: z.string().optional(),
+			version: z.string().optional(),
+			offset: z.number().int().min(0).optional(),
+			limit: z.number().int().min(1).max(2e4).optional()
+		}
+	}, run("read"));
+	server.registerTool("xplat_guidance", {
+		description: "Retrieve tailored guidance for the selected app’s actual installed package versions.",
+		inputSchema: {}
+	}, run("guidance"));
+}
+//#endregion
+export { registerDocsTools };

package/dist/inspection/service.js

@@ -0,0 +1,3 @@
+import { registerInspectionTools } from "./tools.js";
+import { createInspectionService } from "@octane-xplat/cli/mcp/inspection/service";
+export { createInspectionService, registerInspectionTools };

package/dist/inspection/tools.js

@@ -0,0 +1,43 @@
+import { z } from "zod";
+//#region src/inspection/tools.ts
+function registerInspectionTools(server, context, respond) {
+	const control = z.object({
+		kind: z.enum(["id", "testID"]),
+		name: z.string().min(1).max(200)
+	});
+	const run = (method) => async (args) => {
+		const data = await context.inspection[method](args);
+		return data.error ? respond({
+			ok: false,
+			error: data.error
+		}) : respond({
+			ok: true,
+			data
+		});
+	};
+	server.registerTool("xplat_inspect", {
+		description: "Bounded main-document named DOM hosts in the owned Chromium session. Explicit id/testID selector; duplicates fail. Password/private values are redacted. Includes document/session/build identity and coverage.",
+		inputSchema: {
+			sessionId: z.string(),
+			control: control.optional(),
+			offset: z.number().int().min(0).optional(),
+			limit: z.number().int().min(1).max(100).optional()
+		}
+	}, run("inspect"));
+	server.registerTool("xplat_interact", {
+		description: "Send scoped input to one stable control from an inspected document. dom-event sends a CDP mouse click; os-input sends Space/Enter via the macOS event system to owned headed Chromium. Reserve desktop input for OS actions. Input delivery is not an app assertion.",
+		inputSchema: {
+			sessionId: z.string(),
+			documentId: z.string(),
+			control,
+			mechanism: z.enum(["dom-event", "os-input"]),
+			key: z.enum(["Space", "Enter"]).optional().default("Space")
+		}
+	}, run("interact"));
+	server.registerTool("xplat_screenshot", {
+		description: "Capture the owned Chromium viewport only with a current visual-capture grant. Returns a session-scoped artifact and provenance; capability discovery never grants approval.",
+		inputSchema: { sessionId: z.string() }
+	}, run("screenshot"));
+}
+//#endregion
+export { registerInspectionTools };

package/dist/runtime/logs.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/runtime/logs";

package/dist/runtime/process.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/runtime/process";

package/dist/runtime/service.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/runtime/service";

package/dist/runtime/targets.js

@@ -0,0 +1 @@
+export * from "@octane-xplat/cli/mcp/runtime/targets";