@oharness/engine 0.1.0

package/dist/mcp/registry.json

@@ -0,0 +1,293 @@
+{
+  "$comment": [
+    "Connector registry. This is DATA, not code — edit it without touching the harness.",
+    "",
+    "Precedence, later wins:",
+    "  1. this bundled file",
+    "  2. ~/.oharness/connectors.json",
+    "  3. OHARNESS_CONNECTORS, if set, in place of (2)",
+    "",
+    "WHAT BELONGS HERE. Not a directory — there are registries with five figures",
+    "of servers in them and this will never be one. It is a starting point, so",
+    "the bar is: published by whoever owns the data it exposes (no repackagers,",
+    "no middlemen), reachable over streamable HTTP or runnable from a package",
+    "manager already present, and usable after one click or one named variable.",
+    "Anything else is one line in (2), which is the same shape as this file.",
+    "",
+    "The list being short is not the list being the limit. Any server that",
+    "follows the spec works whether or not it has a row here: a remote one",
+    "answers 401, the challenge names its authorization server, a client gets",
+    "registered against it on the spot, and the tokens land in auth.json under",
+    "0600. Rows here save you a URL, nothing more.",
+    "",
+    "STREAMABLE HTTP ONLY. The `/sse` endpoints several vendors still publish",
+    "are the older two-channel transport, which this harness does not speak.",
+    "Every vendor below that has one also serves the same server at a streamable",
+    "HTTP path, and that is the URL used here.",
+    "",
+    "SECRETS. Nothing here carries one and nothing here should. Servers that log",
+    "in do it through the browser. A server that wants a plain API key instead",
+    "says ${env:NAME} — in a header, an argument, a URL, or a child process's",
+    "environment. The reference is what gets written to the config file and the",
+    "value is read from the environment at connect time, so a config that is",
+    "shared, synced or committed never contains the key. Entries that need one",
+    "say so in the menu before they are picked, not after.",
+    "",
+    "`siteUrl` is where the menu goes looking for the vendor's icon. The server fetches it once and caches it, so the page itself never talks to a third party; an entry without one, or whose site has no usable icon, draws a monogram instead.",
+    "",
+    "`${project}` is replaced with the session's working directory and `${home}`",
+    "with the home directory when the server is started.",
+    "",
+    "`npx` entries need Node, which is already running. `uvx` entries need uv",
+    "(https://docs.astral.sh/uv); a missing runtime is reported when the",
+    "connector fails to start rather than hidden here.",
+    "",
+    "`verified` is the day `node script/verify-connectors.ts` last reported every",
+    "remote entry below reachable, with a discoverable authorization server and,",
+    "where it logs in through the browser, dynamic client registration. These",
+    "move; re-run it rather than trusting the date."
+  ],
+  "verified": "2026-08-21",
+  "connectors": {
+    "filesystem": {
+      "label": "Filesystem",
+      "publisher": "Model Context Protocol",
+      "description": "Read, write and search files under one directory — the project, unless you change it",
+      "docsUrl": "https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem",
+      "siteUrl": "https://modelcontextprotocol.io",
+      "config": {
+        "type": "stdio",
+        "command": "npx",
+        "args": [
+          "-y",
+          "@modelcontextprotocol/server-filesystem",
+          "${project}"
+        ]
+      }
+    },
+    "memory": {
+      "label": "Memory",
+      "publisher": "Model Context Protocol",
+      "description": "A knowledge graph the agent can write to and read back in later sessions",
+      "docsUrl": "https://github.com/modelcontextprotocol/servers/tree/main/src/memory",
+      "siteUrl": "https://modelcontextprotocol.io",
+      "config": {
+        "type": "stdio",
+        "command": "npx",
+        "args": [
+          "-y",
+          "@modelcontextprotocol/server-memory"
+        ]
+      }
+    },
+    "sequential-thinking": {
+      "label": "Sequential thinking",
+      "publisher": "Model Context Protocol",
+      "description": "A scratchpad for working a problem through in steps, revising as it goes",
+      "docsUrl": "https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking",
+      "siteUrl": "https://modelcontextprotocol.io",
+      "config": {
+        "type": "stdio",
+        "command": "npx",
+        "args": [
+          "-y",
+          "@modelcontextprotocol/server-sequential-thinking"
+        ]
+      }
+    },
+    "fetch": {
+      "label": "Fetch",
+      "publisher": "Model Context Protocol",
+      "description": "Fetch a URL and convert it to markdown for reading",
+      "docsUrl": "https://github.com/modelcontextprotocol/servers/tree/main/src/fetch",
+      "siteUrl": "https://modelcontextprotocol.io",
+      "config": {
+        "type": "stdio",
+        "command": "uvx",
+        "args": [
+          "mcp-server-fetch"
+        ]
+      }
+    },
+    "git": {
+      "label": "Git",
+      "publisher": "Model Context Protocol",
+      "description": "Read history, diffs and blame in this repository",
+      "docsUrl": "https://github.com/modelcontextprotocol/servers/tree/main/src/git",
+      "siteUrl": "https://modelcontextprotocol.io",
+      "config": {
+        "type": "stdio",
+        "command": "uvx",
+        "args": [
+          "mcp-server-git",
+          "--repository",
+          "${project}"
+        ]
+      }
+    },
+    "time": {
+      "label": "Time",
+      "publisher": "Model Context Protocol",
+      "description": "The current time in any timezone, and conversions between them",
+      "docsUrl": "https://github.com/modelcontextprotocol/servers/tree/main/src/time",
+      "siteUrl": "https://modelcontextprotocol.io",
+      "config": {
+        "type": "stdio",
+        "command": "uvx",
+        "args": [
+          "mcp-server-time"
+        ]
+      }
+    },
+    "everything": {
+      "label": "Everything",
+      "publisher": "Model Context Protocol",
+      "description": "The reference server: one of every MCP feature, for trying the wiring out",
+      "docsUrl": "https://github.com/modelcontextprotocol/servers/tree/main/src/everything",
+      "siteUrl": "https://modelcontextprotocol.io",
+      "config": {
+        "type": "stdio",
+        "command": "npx",
+        "args": [
+          "-y",
+          "@modelcontextprotocol/server-everything"
+        ]
+      }
+    },
+    "linear": {
+      "label": "Linear",
+      "publisher": "Linear",
+      "description": "Issues, projects and cycles — read them, file them, move them along",
+      "docsUrl": "https://linear.app/docs/mcp",
+      "siteUrl": "https://linear.app",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.linear.app/mcp"
+      }
+    },
+    "notion": {
+      "label": "Notion",
+      "publisher": "Notion",
+      "description": "Search the workspace, read pages and databases, and write back to them",
+      "docsUrl": "https://developers.notion.com/docs/mcp",
+      "siteUrl": "https://www.notion.com",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.notion.com/mcp"
+      }
+    },
+    "sentry": {
+      "label": "Sentry",
+      "publisher": "Sentry",
+      "description": "Issues, events and stack traces from your projects, with the context around them",
+      "docsUrl": "https://docs.sentry.io/product/sentry-mcp/",
+      "siteUrl": "https://sentry.io",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.sentry.dev/mcp"
+      }
+    },
+    "asana": {
+      "label": "Asana",
+      "publisher": "Asana",
+      "description": "Tasks, projects and workloads across the workspaces you can see",
+      "docsUrl": "https://developers.asana.com/docs/mcp-server",
+      "siteUrl": "https://asana.com",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.asana.com/mcp"
+      }
+    },
+    "deepwiki": {
+      "label": "DeepWiki",
+      "publisher": "Cognition",
+      "description": "Ask questions about any public GitHub repository and get answers with sources",
+      "docsUrl": "https://docs.devin.ai/work-with-devin/deepwiki-mcp",
+      "siteUrl": "https://deepwiki.com",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.deepwiki.com/mcp"
+      }
+    },
+    "huggingface": {
+      "label": "Hugging Face",
+      "publisher": "Hugging Face",
+      "description": "Search models, datasets, papers and Spaces, and read their cards",
+      "docsUrl": "https://huggingface.co/settings/mcp",
+      "siteUrl": "https://huggingface.co",
+      "config": {
+        "type": "http",
+        "url": "https://huggingface.co/mcp"
+      }
+    },
+    "github": {
+      "label": "GitHub",
+      "publisher": "GitHub",
+      "description": "Repositories, issues, pull requests and code search. Needs GITHUB_TOKEN",
+      "docsUrl": "https://github.com/github/github-mcp-server",
+      "siteUrl": "https://github.com",
+      "config": {
+        "type": "http",
+        "url": "https://api.githubcopilot.com/mcp/",
+        "headers": {
+          "authorization": "Bearer ${env:GITHUB_TOKEN}"
+        }
+      }
+    },
+    "supabase": {
+      "label": "Supabase",
+      "publisher": "Supabase",
+      "description": "Projects, tables, migrations, edge functions and logs",
+      "docsUrl": "https://supabase.com/docs/guides/getting-started/mcp",
+      "siteUrl": "https://supabase.com",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.supabase.com/mcp"
+      }
+    },
+    "vercel": {
+      "label": "Vercel",
+      "publisher": "Vercel",
+      "description": "Projects and deployments, with the build and runtime logs behind them",
+      "docsUrl": "https://vercel.com/docs/mcp/vercel-mcp",
+      "siteUrl": "https://vercel.com",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.vercel.com"
+      }
+    },
+    "atlassian": {
+      "label": "Atlassian",
+      "publisher": "Atlassian",
+      "description": "Jira issues and Confluence pages across the sites you can see",
+      "docsUrl": "https://support.atlassian.com/rovo/docs/setting-up-ides/",
+      "siteUrl": "https://www.atlassian.com",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.atlassian.com/v1/mcp"
+      }
+    },
+    "figma": {
+      "label": "Figma",
+      "publisher": "Figma",
+      "description": "Read designs, frames and variables from files you have access to",
+      "docsUrl": "https://developers.figma.com/docs/figma-mcp-server/",
+      "siteUrl": "https://www.figma.com",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.figma.com/mcp"
+      }
+    },
+    "stripe": {
+      "label": "Stripe",
+      "publisher": "Stripe",
+      "description": "Customers, payments and subscriptions, plus search across the docs",
+      "docsUrl": "https://docs.stripe.com/mcp",
+      "siteUrl": "https://stripe.com",
+      "config": {
+        "type": "http",
+        "url": "https://mcp.stripe.com"
+      }
+    }
+  }
+}

package/dist/mcp/secrets.d.ts

@@ -0,0 +1,20 @@
+import type { McpServerConfig } from "./client.ts";
+/** Every environment variable a configuration refers to, in source order. */
+export declare function referencedSecrets(config: McpServerConfig): string[];
+/**
+ * The referenced variables that are not set.
+ *
+ * Empty counts as missing: an unset key and a key set to "" fail the same way
+ * at the server, and reporting the second as configured sends the user looking
+ * in the wrong place.
+ */
+export declare function missingSecrets(config: McpServerConfig, env?: NodeJS.ProcessEnv): string[];
+/**
+ * A copy of the configuration with its references resolved.
+ *
+ * A missing variable resolves to the empty string rather than throwing, so the
+ * failure lands where it is legible — the server rejecting an empty credential
+ * — but callers that can say something better should check `missingSecrets`
+ * first and never get here.
+ */
+export declare function expandSecrets(config: McpServerConfig, env?: NodeJS.ProcessEnv): McpServerConfig;

package/dist/mcp/secrets.js

@@ -0,0 +1,75 @@
+/**
+ * `${env:NAME}` in a server's configuration, resolved at connect time.
+ *
+ * The whole reason this is a placeholder and not a value is that an MCP
+ * configuration is a file on disk — in `~/.oharness/config.json`, or checked
+ * into a repository — and a bearer token written into one is a token that
+ * leaks with the file. Keeping the reference means the config stays shareable
+ * and the secret stays in the environment, where a keychain, a `.env` loader
+ * or a CI secret store can own it.
+ *
+ * This is the same syntax on every field that can carry one: a URL, a header,
+ * an argument, a child process's environment. A connector that wants an API
+ * key in a query string and one that wants it in a header should not need two
+ * different answers.
+ */
+const REFERENCE = /\$\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g;
+/** Every environment variable a configuration refers to, in source order. */
+export function referencedSecrets(config) {
+    const names = new Set();
+    for (const value of strings(config)) {
+        for (const match of value.matchAll(REFERENCE))
+            names.add(match[1]);
+    }
+    return [...names];
+}
+/**
+ * The referenced variables that are not set.
+ *
+ * Empty counts as missing: an unset key and a key set to "" fail the same way
+ * at the server, and reporting the second as configured sends the user looking
+ * in the wrong place.
+ */
+export function missingSecrets(config, env = process.env) {
+    return referencedSecrets(config).filter((name) => !env[name]);
+}
+/**
+ * A copy of the configuration with its references resolved.
+ *
+ * A missing variable resolves to the empty string rather than throwing, so the
+ * failure lands where it is legible — the server rejecting an empty credential
+ * — but callers that can say something better should check `missingSecrets`
+ * first and never get here.
+ */
+export function expandSecrets(config, env = process.env) {
+    const fill = (value) => value.replace(REFERENCE, (_, name) => env[name] ?? "");
+    const fillAll = (values) => Object.fromEntries(Object.entries(values).map(([key, value]) => [key, fill(value)]));
+    if (config.type === "http") {
+        return {
+            ...config,
+            url: fill(config.url),
+            ...(config.headers ? { headers: fillAll(config.headers) } : {}),
+        };
+    }
+    return {
+        ...config,
+        command: fill(config.command),
+        ...(config.args ? { args: config.args.map(fill) } : {}),
+        ...(config.cwd ? { cwd: fill(config.cwd) } : {}),
+        ...(config.env ? { env: fillAll(config.env) } : {}),
+    };
+}
+/** Every string field that may carry a reference. */
+function* strings(config) {
+    if (config.type === "http") {
+        yield config.url;
+        yield* Object.values(config.headers ?? {});
+        return;
+    }
+    yield config.command;
+    yield* config.args ?? [];
+    if (config.cwd)
+        yield config.cwd;
+    yield* Object.values(config.env ?? {});
+}
+//# sourceMappingURL=secrets.js.map

package/dist/mcp/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/mcp/secrets.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,SAAS,GAAG,qCAAqC,CAAC;AAExD,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,MAAuB;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAuB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IACvE,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,MAAuB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IACtE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CACrC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,CAAC,MAA8B,EAA0B,EAAE,CACzE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,MAAM;YACT,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YACrB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAuB;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,GAAG,CAAC;QACjB,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,CAAC,OAAO,CAAC;IACrB,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IACzB,IAAI,MAAM,CAAC,GAAG;QAAE,MAAM,MAAM,CAAC,GAAG,CAAC;IACjC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/mcp/transport.d.ts

@@ -0,0 +1,51 @@
+import type { JsonRpcMessage } from "./protocol.ts";
+export interface Transport {
+    readonly kind: "stdio" | "http";
+    start(onMessage: (msg: JsonRpcMessage) => void, onClose: (reason?: string) => void): Promise<void>;
+    send(message: JsonRpcMessage): Promise<void>;
+    close(): Promise<void>;
+}
+export interface StdioTransportOptions {
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+    cwd?: string;
+    serverName: string;
+}
+export declare class StdioTransport implements Transport {
+    readonly kind = "stdio";
+    private child?;
+    private buffer;
+    private closed;
+    private readonly opts;
+    constructor(opts: StdioTransportOptions);
+    start(onMessage: (msg: JsonRpcMessage) => void, onClose: (reason?: string) => void): Promise<void>;
+    send(message: JsonRpcMessage): Promise<void>;
+    close(): Promise<void>;
+}
+export interface HttpTransportOptions {
+    url: string;
+    headers?: Record<string, string>;
+    /**
+     * Headers resolved per request rather than at construction.
+     *
+     * Access tokens expire, so anything that captures one when the transport is
+     * built works until it abruptly does not. This is called on every send and
+     * owns its own refresh.
+     */
+    auth?(): Promise<Record<string, string>>;
+    serverName: string;
+    timeoutMs?: number;
+}
+export declare class HttpTransport implements Transport {
+    readonly kind = "http";
+    private sessionId?;
+    private onMessage?;
+    private onClose?;
+    private closed;
+    private readonly opts;
+    constructor(opts: HttpTransportOptions);
+    start(onMessage: (msg: JsonRpcMessage) => void, onClose: (reason?: string) => void): Promise<void>;
+    send(message: JsonRpcMessage): Promise<void>;
+    close(): Promise<void>;
+}

package/dist/mcp/transport.js

@@ -0,0 +1,158 @@
+import { spawn } from "node:child_process";
+import { McpAuthRequiredError, McpError } from "../core/errors.js";
+import { parseSse } from "../providers/http.js";
+import { parseJson } from "../util/json.js";
+export class StdioTransport {
+    kind = "stdio";
+    child;
+    buffer = "";
+    closed = false;
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async start(onMessage, onClose) {
+        const child = spawn(this.opts.command, this.opts.args ?? [], {
+            cwd: this.opts.cwd,
+            // MCP servers commonly need PATH and HOME; merge rather than replace.
+            env: { ...process.env, ...this.opts.env },
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        this.child = child;
+        child.stdout.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => {
+            this.buffer += chunk;
+            let newline;
+            while ((newline = this.buffer.indexOf("\n")) !== -1) {
+                const line = this.buffer.slice(0, newline).trim();
+                this.buffer = this.buffer.slice(newline + 1);
+                if (line === "")
+                    continue;
+                const parsed = parseJson(line);
+                // Servers sometimes log to stdout; ignore anything that isn't JSON-RPC.
+                if (parsed.ok)
+                    onMessage(parsed.value);
+            }
+        });
+        // stderr is the server's log channel, not part of the protocol.
+        child.stderr.setEncoding("utf8");
+        child.stderr.on("data", () => { });
+        child.on("error", (err) => {
+            if (this.closed)
+                return;
+            this.closed = true;
+            onClose(`failed to start ${this.opts.command}: ${err.message}`);
+        });
+        child.on("close", (code) => {
+            if (this.closed)
+                return;
+            this.closed = true;
+            onClose(code === 0 ? undefined : `server exited with code ${code}`);
+        });
+        await new Promise((resolve, reject) => {
+            const timer = setTimeout(resolve, 100);
+            child.once("error", (err) => {
+                clearTimeout(timer);
+                reject(new McpError(this.opts.serverName, `spawn failed: ${err.message}`, err));
+            });
+        });
+    }
+    async send(message) {
+        if (!this.child || this.closed) {
+            throw new McpError(this.opts.serverName, "transport is not connected");
+        }
+        this.child.stdin.write(`${JSON.stringify(message)}\n`);
+    }
+    async close() {
+        this.closed = true;
+        this.child?.stdin.end();
+        this.child?.kill();
+    }
+}
+export class HttpTransport {
+    kind = "http";
+    sessionId;
+    onMessage;
+    onClose;
+    closed = false;
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async start(onMessage, onClose) {
+        this.onMessage = onMessage;
+        this.onClose = onClose;
+    }
+    async send(message) {
+        if (this.closed)
+            throw new McpError(this.opts.serverName, "transport is closed");
+        // Applied last, so a credential obtained by logging in wins over a stale
+        // one left behind in a config file rather than being shadowed by it.
+        const auth = this.opts.auth ? await this.opts.auth() : {};
+        const response = await fetch(this.opts.url, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                // Streamable HTTP servers may answer with either a JSON body or an
+                // SSE stream, and choose based on this header.
+                accept: "application/json, text/event-stream",
+                ...(this.sessionId ? { "mcp-session-id": this.sessionId } : {}),
+                ...this.opts.headers,
+                ...auth,
+            },
+            body: JSON.stringify(message),
+            signal: AbortSignal.timeout(this.opts.timeoutMs ?? 120_000),
+        });
+        const session = response.headers.get("mcp-session-id");
+        if (session)
+            this.sessionId = session;
+        if (response.status === 401) {
+            // Not reported as a failure: it is the server asking who we are, and the
+            // challenge carries where that question gets answered.
+            await response.body?.cancel().catch(() => { });
+            throw new McpAuthRequiredError(this.opts.serverName, this.opts.url, response.headers.get("www-authenticate") ?? undefined);
+        }
+        if (!response.ok) {
+            const detail = await response.text().catch(() => "");
+            throw new McpError(this.opts.serverName, `HTTP ${response.status} ${response.statusText}: ${detail.slice(0, 400)}`);
+        }
+        // 202 Accepted is the normal reply to a notification.
+        if (response.status === 202)
+            return;
+        const contentType = response.headers.get("content-type") ?? "";
+        if (contentType.includes("text/event-stream") && response.body) {
+            for await (const event of parseSse(response.body)) {
+                if (event.data === "" || event.data === "[DONE]")
+                    continue;
+                const parsed = parseJson(event.data);
+                if (parsed.ok)
+                    this.onMessage?.(parsed.value);
+            }
+            return;
+        }
+        const text = await response.text();
+        if (text.trim() === "")
+            return;
+        const parsed = parseJson(text);
+        if (!parsed.ok) {
+            throw new McpError(this.opts.serverName, `invalid JSON response: ${parsed.error}`);
+        }
+        for (const msg of Array.isArray(parsed.value) ? parsed.value : [parsed.value]) {
+            this.onMessage?.(msg);
+        }
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        if (this.sessionId) {
+            // Best effort: tell the server it can release the session.
+            await fetch(this.opts.url, {
+                method: "DELETE",
+                headers: { "mcp-session-id": this.sessionId, ...this.opts.headers },
+            }).catch(() => { });
+        }
+        this.onClose?.();
+    }
+}
+//# sourceMappingURL=transport.js.map

package/dist/mcp/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/mcp/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAsB5C,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,OAAO,CAAC;IAChB,KAAK,CAAkC;IACvC,MAAM,GAAG,EAAE,CAAC;IACZ,MAAM,GAAG,KAAK,CAAC;IACN,IAAI,CAAwB;IAE7C,YAAY,IAA2B;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK,CACT,SAAwC,EACxC,OAAkC;QAElC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE;YAC3D,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG;YAClB,sEAAsE;YACtE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YACzC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QAEnB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC;YACrB,IAAI,OAAe,CAAC;YACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAClD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBAC7C,IAAI,IAAI,KAAK,EAAE;oBAAE,SAAS;gBAC1B,MAAM,MAAM,GAAG,SAAS,CAAiB,IAAI,CAAC,CAAC;gBAC/C,wEAAwE;gBACxE,IAAI,MAAM,CAAC,EAAE;oBAAE,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,gEAAgE;QAChE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAElC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,OAAO,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO;YACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB;QAChC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACrB,CAAC;CACF;AAqBD,MAAM,OAAO,aAAa;IACf,IAAI,GAAG,MAAM,CAAC;IACf,SAAS,CAAU;IACnB,SAAS,CAAiC;IAC1C,OAAO,CAA6B;IACpC,MAAM,GAAG,KAAK,CAAC;IACN,IAAI,CAAuB;IAE5C,YAAY,IAA0B;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK,CACT,SAAwC,EACxC,OAAkC;QAElC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB;QAChC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAEjF,yEAAyE;QACzE,qEAAqE;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAE1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,mEAAmE;gBACnE,+CAA+C;gBAC/C,MAAM,EAAE,qCAAqC;gBAC7C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO;gBACpB,GAAG,IAAI;aACR;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;SAC5D,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACvD,IAAI,OAAO;YAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC;QAEtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,yEAAyE;YACzE,uDAAuD;YACvD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,oBAAoB,CAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,IAAI,CAAC,IAAI,CAAC,GAAG,EACb,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CACtD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,QAAQ,CAChB,IAAI,CAAC,IAAI,CAAC,UAAU,EACpB,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAC1E,CAAC;QACJ,CAAC;QAED,sDAAsD;QACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO;QAEpC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/D,IAAI,WAAW,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/D,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAC3D,MAAM,MAAM,GAAG,SAAS,CAAiB,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrD,IAAI,MAAM,CAAC,EAAE;oBAAE,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChD,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAoC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,0BAA0B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,2DAA2D;YAC3D,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACzB,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE;aACpE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IACnB,CAAC;CACF"}

package/dist/paths.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Where OHarness keeps everything that outlives a project: credentials,
+ * sessions, the model catalog, user-level skills, agents and plugins.
+ *
+ * One resolver, because nine call sites each computing `homedir()` themselves
+ * is how `OHARNESS_HOME` ended up honoured by the session store and ignored
+ * by the other eight — an escape hatch that only worked for one kind of data
+ * is worse than none, since it reads as if the whole thing is redirected.
+ *
+ * Set `OHARNESS_HOME` to redirect all of it. Developing on the harness
+ * itself should always set it (the repo's npm scripts do), so working on the
+ * tool never writes into the home directory of the person working on it.
+ */
+export declare function userDir(): string;
+/** A path inside the user directory, e.g. `userPath("sessions")`. */
+export declare function userPath(...segments: string[]): string;
+/**
+ * Project-local storage: `.oharness/` in the working directory.
+ *
+ * Kept separate from the user directory on purpose. Settings, skills and
+ * agents exist at both levels and the merge order between them is meaningful,
+ * so collapsing them into one path helper would blur a distinction the
+ * permission and skill layers depend on.
+ */
+export declare function projectPath(cwd: string, ...segments: string[]): string;
+/**
+ * Expand a leading `~` the way a shell would, and leave everything else alone.
+ *
+ * Lives here rather than in the workspace policy because both the policy and
+ * the file tools need it and neither may import the other. A path the agent
+ * typed as `~/.oharness/skills` has to become the same string the shell would
+ * have produced, or a refusal message ends up naming a path that exists
+ * nowhere and the reader learns nothing from it.
+ */
+export declare function expandHome(input: string): string;
+/** Whether `target` is one of `roots` or sits underneath one. */
+export declare function within(roots: readonly string[], target: string): boolean;