@prodero/curator 0.0.0-stage → 0.1.0

package/dist/hosts/runtime.js

@@ -0,0 +1,139 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { adapters, block, replaceBlock, LAUNCHER, GLOBAL_START, GLOBAL_END, MCP_START, MCP_END } from './adapters.js';
+import { environment, expectedEntry, inspect, receiptSchema } from './manager.js';
+import { verifyPublicEntry, resolveNpmCli } from './public-entry.js';
+import { read, fail, transact } from './files.js';
+const stable = (value) => JSON.stringify(value, (_key, item) => item && typeof item === 'object' && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => a.localeCompare(b))) : item);
+async function packageEntry(host, entry, env) {
+    // Accept historical receipt targets only to migrate them to the public executable.
+    const cli = entry.args.length === 2 && entry.args[1] === 'mcp' && path.isAbsolute(entry.args[0])
+        ? entry.args[0] : path.resolve(path.dirname(entry.command), '../dist/cli.js');
+    const adapter = { id: host };
+    const result = expectedEntry(adapter, cli, env);
+    await verifyPublicEntry(result);
+    return result;
+}
+async function readPackage(root) {
+    try {
+        return JSON.parse(await fs.readFile(path.join(root, 'package.json'), 'utf8'));
+    }
+    catch {
+        return fail('HOST_RUNTIME_MISSING', 'Cannot read the selected runtime package.json. No settings changed.');
+    }
+}
+async function developmentEntry(host, checkout, env) {
+    if (!path.isAbsolute(checkout))
+        fail('HOST_UNSUPPORTED_PATH', '--checkout must be an absolute Prodero repository path.');
+    const root = await fs.realpath(checkout).catch(() => fail('HOST_RUNTIME_MISSING', 'Development checkout does not exist.'));
+    const metadata = await readPackage(root);
+    if (!['@prodero/curator', '@prodero/cli'].includes(metadata.name ?? '') || !metadata.scripts?.['mcp:dev'])
+        fail('HOST_RUNTIME_MISSING', 'Select a Prodero checkout with an mcp:dev script.');
+    for (const relative of ['src/cli.ts', 'scripts/mcp-dev.ts', 'scripts/mcp-dev-launcher.mjs', 'node_modules/tsx/package.json']) {
+        if (!(await fs.stat(path.join(root, relative)).catch(() => null))?.isFile())
+            fail('HOST_RUNTIME_MISSING', 'Development source or dependencies are missing. Install checkout dependencies first.');
+    }
+    await resolveNpmCli(env);
+    return { root };
+}
+/** Refuse to silently switch a global registration shadowed by workspace policy. */
+async function checkWorkspace(host, workspace, globalConfig, nativeConfig) {
+    if (!path.isAbsolute(workspace))
+        fail('HOST_UNSUPPORTED_PATH', '--workspace must be absolute.');
+    workspace = await fs.realpath(workspace).catch(() => fail('HOST_SCOPE_CONFLICT', 'The selected workspace does not exist.'));
+    if (!(await fs.stat(workspace)).isDirectory())
+        fail('HOST_SCOPE_CONFLICT', 'The selected workspace is not a directory.');
+    const globalReal = await fs.realpath(globalConfig).catch(() => globalConfig);
+    for (let dir = path.resolve(workspace);; dir = path.dirname(dir)) {
+        const relatives = host === 'codex' ? ['.codex/config.toml'] : ['.mcp.json', '.claude/settings.json', '.claude/settings.local.json'];
+        for (const relative of relatives) {
+            const file = path.join(dir, relative);
+            if (file === globalConfig || await fs.realpath(file).catch(() => null) === globalReal)
+                continue;
+            const text = await fs.readFile(file, 'utf8').catch((error) => {
+                if (error.code === 'ENOENT')
+                    return '';
+                return fail('HOST_SCOPE_CONFLICT', 'Cannot inspect workspace MCP overrides. No settings changed.');
+            });
+            if (/prodero/i.test(text))
+                fail('HOST_SCOPE_CONFLICT', `Workspace Prodero settings in ${file} require review before switching the user-level connection.`);
+        }
+        if (dir === path.dirname(dir))
+            break;
+    }
+    if (host === 'claude') {
+        const projects = JSON.parse(nativeConfig).projects ?? {};
+        for (const [project, settings] of Object.entries(projects)) {
+            const relative = path.relative(project, workspace);
+            if ((relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))) && /prodero/i.test(JSON.stringify(settings))) {
+                fail('HOST_SCOPE_CONFLICT', 'Claude project-specific Prodero settings require review before switching the user-level connection.');
+            }
+        }
+    }
+}
+/** Explicit single-host operation. Never discovers a target host or updates the running process. */
+export async function switchRuntime(hostId, mode, options = {}) {
+    if (hostId !== 'codex' && hostId !== 'claude')
+        fail('HOST_UNKNOWN', 'Choose exactly one host: codex or claude.');
+    if (mode !== 'package' && mode !== 'dev')
+        fail('HOST_RUNTIME_MODE', 'Choose package or dev.');
+    if (options.packageRoot && !path.isAbsolute(options.packageRoot))
+        fail('HOST_UNSUPPORTED_PATH', '--package-root must be absolute.');
+    const ctx = environment(options);
+    const host = (await adapters(ctx.home, ctx.env, hostId))[0];
+    const view = await inspect(host, ctx, false, true);
+    await checkWorkspace(hostId, options.workspace ?? process.cwd(), host.config, view.text);
+    const { receipt } = view;
+    const migrating = !receipt && ['externally-configured', 'external-incomplete'].includes(view.base.state);
+    if (!receipt && !migrating)
+        fail('HOST_NOT_INSTALLED', 'Configure this agent with prodero install before switching runtimes.');
+    if (migrating && !options.adoptDev && !options.dryRun)
+        fail('HOST_ADOPTION_REQUIRED', 'Preview with --dry-run, then use --adopt-dev to migrate this manual prodero-dev registration.');
+    const stored = receipt?.format === 2 ? receipt.runtime : undefined;
+    const selectedPackage = options.packageRoot
+        ? expectedEntry(host, path.join(options.packageRoot, 'dist/cli.js'))
+        : stored?.packageEntry ?? receipt?.entry ?? expectedEntry(host, fileURLToPath(new URL('../cli.js', import.meta.url)));
+    const packaged = await packageEntry(hostId, selectedPackage, ctx.env);
+    let devRoot = stored?.devRoot ?? null, devEntry = stored?.devEntry ?? null;
+    if (mode === 'dev') {
+        const checkout = options.checkout ?? devRoot;
+        if (!checkout)
+            fail('HOST_RUNTIME_MISSING', 'Supply --checkout with the absolute Prodero repository path.');
+        const development = await developmentEntry(hostId, checkout, ctx.env);
+        devRoot = development.root;
+        let explicit = false;
+        const other = hostId === 'codex' ? 'claude' : 'codex';
+        const saved = await read(ctx.home, path.join(ctx.state, other, 'receipt.json'));
+        if (saved !== null) {
+            const otherReceipt = receiptSchema.parse(JSON.parse(saved));
+            explicit = otherReceipt.format === 2 && Boolean(otherReceipt.runtime.devRoot) && otherReceipt.runtime.devRoot !== devRoot;
+        }
+        devEntry = { ...packaged, args: ['mcp', '--dev', ...(explicit ? ['--checkout', devRoot] : [])] };
+    }
+    const entry = mode === 'dev' ? devEntry : packaged;
+    const config = host.edit(migrating ? host.removeAlternate(view.text) : view.text, entry);
+    const launcher = replaceBlock(view.launcher ?? '', GLOBAL_START, GLOBAL_END, LAUNCHER);
+    const next = {
+        format: 2, host: hostId, config: host.config, launcherPath: view.launcherPath,
+        entry, launcher: LAUNCHER, mcpBlock: hostId === 'codex' ? block(config, MCP_START, MCP_END).text : null,
+        originalConfig: receipt ? receipt.originalConfig : view.config,
+        originalLauncher: receipt ? receipt.originalLauncher : view.launcher,
+        installedConfig: config, installedLauncher: launcher,
+        runtime: { mode, packageEntry: packaged, devRoot, devEntry },
+    };
+    receiptSchema.parse(next);
+    host.inspectConfig(config);
+    const unchanged = receipt?.format === 2 && stable(receipt.runtime) === stable(next.runtime) && stable(host.entry(view.text)) === stable(entry) && launcher === view.launcher;
+    const plan = { host: hostId, mode, previousMode: stored?.mode ?? (migrating ? 'manual-dev' : 'package'), changed: !unchanged, migration: migrating,
+        config: host.config, launcher: view.launcherPath, runtimePath: mode === 'dev' ? devRoot : packaged.command, restartRequired: true };
+    if (options.dryRun || unchanged)
+        return { ...plan, dryRun: Boolean(options.dryRun) };
+    await transact(ctx.home, view.dir, [
+        { path: host.config, before: view.config, after: config },
+        { path: view.launcherPath, before: view.launcher, after: launcher },
+        { path: view.receiptPath, before: view.saved, after: JSON.stringify(next, null, 2) + '\n' },
+    ]);
+    return { ...plan, dryRun: false };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/hosts/wizard.js

@@ -0,0 +1,114 @@
+import { createInterface } from 'node:readline/promises';
+import { PRODERO_VERSION } from '../core/constants.js';
+import { machineIntegrations } from './manager.js';
+const labels = {
+    installed: 'Installed',
+    'externally-configured': 'Already configured (prodero-dev, manual)',
+    'external-incomplete': 'Manual setup needs attention',
+    'not-configured': 'Not configured',
+    'not-detected': 'Agent not found',
+    outdated: 'Update available',
+    conflicted: 'Configuration needs review',
+    'unsupported-configuration': 'Cannot read or update configuration',
+    'recovery-required': 'Recovery required',
+    unsupported: 'Not supported yet',
+};
+const actionable = (host) => host.state === 'outdated' || (host.detected && host.state === 'not-configured');
+const needsAttention = (host) => ['conflicted', 'unsupported-configuration', 'recovery-required', 'external-incomplete'].includes(host.state);
+// Native paths can contain terminal control characters. Never render those as commands.
+const printable = (text) => text.replace(/[\x00-\x1f\x7f-\x9f]/g, ' ');
+export async function runInstallWizard(io, options = {}) {
+    io.write(`\n  Prodero ${PRODERO_VERSION} · Installation\n`);
+    io.write('  Configure Prodero for your coding agents.\n');
+    let result = await machineIntegrations('status', undefined, options);
+    while (true) {
+        io.write('\n  Agent          Prodero status\n  ───────────────────────────────────────────────────────────\n');
+        for (const host of result.hosts) {
+            io.write(`  ${host.name.padEnd(15)}${labels[host.state] ?? host.state}${host.runtimeMode === 'dev' ? ' · dev' : ''}${host.support === 'experimental' ? ' · Experimental' : ''}\n`);
+            if (needsAttention(host) || host.state === 'externally-configured') {
+                io.write(`    ${printable(host.message).replace(/^HOST_[A-Z_]+: /, '')}\n`);
+            }
+        }
+        io.write('\n  Status reflects saved settings; server connectivity is not tested.\n');
+        const available = result.hosts.filter(actionable);
+        if (!io.interactive) {
+            io.write('\n  Open an interactive terminal and run prodero install to choose an agent.\n  No settings were changed.\n');
+            return 1;
+        }
+        if (!available.length) {
+            io.write(needsAttentionIn(result.hosts)
+                ? '\n  Review the settings above, then run prodero install again.\n'
+                : '\n  No agents need installation. Run prodero install again after adding an agent.\n');
+            return needsAttentionIn(result.hosts) ? 1 : 0;
+        }
+        io.write('\n  Choose an action\n');
+        available.forEach((host, index) => io.write(`  ${index + 1}. ${host.state === 'outdated' ? 'Update' : 'Install for'} ${host.name}${host.support === 'experimental' ? ' (experimental)' : ''}\n`));
+        io.write('  0. Finish\n\n');
+        const answer = (await io.question('  Selection [0]: '))?.trim();
+        if (answer === null || answer === undefined || answer === '' || answer === '0') {
+            io.write('\n  Finished.\n');
+            return needsAttentionIn(result.hosts) ? 1 : 0;
+        }
+        if (!/^[1-9]\d*$/.test(answer) || !available[Number(answer) - 1]) {
+            io.write('\n  Enter a number from the menu.\n');
+            continue;
+        }
+        const selected = available[Number(answer) - 1];
+        io.write(`\n  ${selected.state === 'outdated' ? 'Update' : 'Install'} Prodero for ${selected.name}\n`);
+        io.write('  This configures the MCP server and global launch instruction.\n  Existing unrelated settings are preserved; changes are backed up locally.\n');
+        if (selected.support === 'experimental')
+            io.write('  Claude Code support is experimental.\n');
+        const confirmation = (await io.question('  Continue? [y/N]: '))?.trim().toLowerCase();
+        if (confirmation !== 'y' && confirmation !== 'yes') {
+            io.write('\n  Cancelled. No settings were changed for this agent.\n');
+            if (confirmation === undefined)
+                return 0;
+            continue;
+        }
+        io.write(`\n  Configuring ${selected.name}…\n`);
+        const installed = await machineIntegrations('install', selected.id, options);
+        const host = installed.hosts.find(item => item.id === selected.id);
+        if (host.state === 'installed') {
+            io.write(`  ✓ Prodero is installed for ${selected.name}.\n  Restart ${selected.name}, open a repository and type prodero.\n`);
+        }
+        else {
+            io.write(`  ${printable(host.message)}\n`);
+        }
+        // Re-read the settings after each action, including failures and concurrent edits.
+        result = await machineIntegrations('status', undefined, options);
+        if (!installed.ok)
+            return 1;
+    }
+}
+function needsAttentionIn(hosts) { return hosts.some(needsAttention); }
+export async function installWizard() {
+    const interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    if (!interactive)
+        return runInstallWizard({ interactive, write: text => process.stdout.write(text), question: async () => null });
+    const terminal = createInterface({ input: process.stdin, output: process.stdout });
+    const abort = new AbortController();
+    terminal.on('close', () => abort.abort());
+    terminal.on('SIGINT', () => terminal.close());
+    try {
+        return await runInstallWizard({
+            interactive,
+            write: text => process.stdout.write(text),
+            async question(prompt) {
+                if (abort.signal.aborted)
+                    return null;
+                try {
+                    return await terminal.question(prompt, { signal: abort.signal });
+                }
+                catch (error) {
+                    if (abort.signal.aborted)
+                        return null;
+                    throw error;
+                }
+            },
+        });
+    }
+    finally {
+        terminal.close();
+    }
+}
+//# sourceMappingURL=wizard.js.map

package/dist/knowledge-table.js

@@ -0,0 +1,38 @@
+const segments = new Intl.Segmenter('en', { granularity: 'grapheme' });
+const width = (s) => {
+    const cp = s.codePointAt(0) ?? 0;
+    return /\p{Extended_Pictographic}/u.test(s) || cp >= 0x1100 && (cp <= 0x115f || cp >= 0x2e80 && cp <= 0xa4cf || cp >= 0xac00 && cp <= 0xd7a3 ||
+        cp >= 0xf900 && cp <= 0xfaff || cp >= 0xfe10 && cp <= 0xfe6f ||
+        cp >= 0xff01 && cp <= 0xff60 || cp >= 0x20000 && cp <= 0x3ffff) ? 2 : 1;
+};
+const cells = (value, limit) => {
+    // Titles are untrusted data: keep terminal controls and Markdown fences out.
+    const text = value.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, '').replace(/[\p{Cc}\p{Cf}]/gu, ' ').replace(/`/g, "'").replace(/\|/g, '/').replace(/\s+/g, ' ').trim();
+    const lines = [];
+    let line = '', used = 0;
+    for (const { segment } of segments.segment(text)) {
+        const size = width(segment);
+        if (used + size > limit) {
+            lines.push(line + ' '.repeat(limit - used));
+            line = '';
+            used = 0;
+        }
+        line += segment;
+        used += size;
+    }
+    lines.push(line + ' '.repeat(limit - used));
+    return lines;
+};
+export function renderKnowledgeTable(rows) {
+    if (!rows.length)
+        return 'No knowledge matches these filters.';
+    const widths = [5, 44, 11, 10, 9];
+    const border = '+' + widths.map(w => '-'.repeat(w + 2)).join('+') + '+';
+    const row = (values) => {
+        const columns = values.map((v, i) => cells(v, widths[i]));
+        return Array.from({ length: Math.max(...columns.map(c => c.length)) }, (_, i) => '| ' + columns.map((c, j) => c[i] ?? ' '.repeat(widths[j])).join(' | ') + ' |').join('\n');
+    };
+    return ['```text', border, row(['#', 'Knowledge', 'Type', 'Priority', 'Layer']), border,
+        ...rows.flatMap(r => [row([r.key, r.title, r.category, r.priority, r.layer]), border]), '```'].join('\n');
+}
+//# sourceMappingURL=knowledge-table.js.map

package/dist/mcp-development.js

@@ -0,0 +1,69 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { environment, receiptSchema } from './hosts/manager.js';
+import { resolveNpmCli } from './hosts/public-entry.js';
+import { read, fail } from './hosts/files.js';
+/** Read installation state only to choose runtime CODE, never workspace authority. */
+export async function developmentRoot(explicit) {
+    if (explicit !== undefined) {
+        if (!path.isAbsolute(explicit))
+            fail('HOST_UNSUPPORTED_PATH', '--checkout must be absolute.');
+        return fs.realpath(explicit);
+    }
+    const { home, state } = environment({});
+    const executable = await fs.realpath(fileURLToPath(new URL('../bin/prodero', import.meta.url)));
+    const roots = new Set();
+    for (const host of ['codex', 'claude']) {
+        const dir = path.join(state, host);
+        const saved = await read(home, path.join(dir, 'receipt.json'));
+        if (saved === null)
+            continue;
+        let receipt;
+        try {
+            receipt = receiptSchema.parse(JSON.parse(saved));
+        }
+        catch {
+            fail('HOST_UNSUPPORTED_CONFIG', 'Invalid integration receipt. Repair the managed integration before using --dev.');
+        }
+        if (receipt.host !== host)
+            fail('HOST_UNSUPPORTED_CONFIG', 'Integration receipt host mismatch.');
+        if (receipt.format !== 2 || !receipt.runtime.devRoot || !receipt.runtime.devEntry)
+            continue;
+        const dev = receipt.runtime.devEntry;
+        // An explicit multi-checkout entry does not compete with an ordinary --dev entry.
+        if (JSON.stringify(dev.args) !== JSON.stringify(['mcp', '--dev']) || await fs.realpath(dev.command).catch(() => null) !== executable)
+            continue;
+        if (await read(home, path.join(dir, 'pending.json')) !== null || await fs.lstat(path.join(dir, 'lock')).catch(() => null))
+            fail('HOST_RECOVERY_REQUIRED', 'Integration update is incomplete. Reconnect after recovery.');
+        const { runtime } = receipt;
+        const stable = (value) => JSON.stringify(value, (_k, v) => v && typeof v === 'object' && !Array.isArray(v) ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => a.localeCompare(b))) : v);
+        if (stable(receipt.entry) !== stable(runtime.mode === 'dev' ? runtime.devEntry : runtime.packageEntry))
+            fail('HOST_UNSUPPORTED_CONFIG', 'Inconsistent runtime receipt.');
+        const root = runtime.devRoot;
+        if (!path.isAbsolute(root) || await fs.realpath(root).catch(() => null) !== root)
+            fail('HOST_RUNTIME_MISSING', 'Saved development checkout was moved or replaced. Select it again with prodero runtime dev.');
+        roots.add(root);
+    }
+    if (roots.size !== 1)
+        fail('HOST_RUNTIME_MISSING', roots.size ? 'Multiple development checkouts are configured. Use an explicit --checkout or switch the host runtime again.' : 'No managed development checkout for this executable. Run prodero runtime dev --host HOST --checkout PATH.');
+    return [...roots][0];
+}
+export async function startDevelopmentRuntime(localStdio, options) {
+    const root = await developmentRoot(options.checkout);
+    let metadata;
+    try {
+        metadata = JSON.parse(await fs.readFile(path.join(root, 'package.json'), 'utf8'));
+    }
+    catch {
+        fail('HOST_RUNTIME_MISSING', 'Cannot read development runtime metadata.');
+    }
+    if (!['@prodero/curator', '@prodero/cli'].includes(metadata.name ?? ''))
+        fail('HOST_RUNTIME_MISSING', 'Development runtime must be a Prodero checkout.');
+    const npmCli = await resolveNpmCli(process.env);
+    const entry = path.join(root, 'scripts/mcp-dev-launcher.mjs');
+    const { startDevelopmentServer } = await import(pathToFileURL(entry).href);
+    // In-process transfer of the captured object: never serialize authority into env or tool metadata.
+    await startDevelopmentServer(localStdio, options.projectRoot, npmCli);
+}
+//# sourceMappingURL=mcp-development.js.map

package/dist/mcp-workspace.js

@@ -0,0 +1,141 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import fs from 'node:fs/promises';
+import { realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { explicitProjectRoot } from './core/project-root.js';
+function pin(value) {
+    if (!value.trim() || !path.isAbsolute(value))
+        throw new Error('Project root must be an absolute existing directory.');
+    try {
+        const canonical = realpathSync(value);
+        if (!statSync(canonical).isDirectory())
+            throw new Error();
+        return Object.freeze({ path: path.resolve(value), canonical });
+    }
+    catch {
+        throw new Error('Project root is not an existing directory.');
+    }
+}
+/** Capture before build/npm can change the workspace. PWD and INIT_CWD are never read. */
+export function captureLocalStdioContext() {
+    let claudeProject, invalidClaudeProject = false;
+    if (process.env.CLAUDE_PROJECT_DIR !== undefined) {
+        try {
+            claudeProject = pin(process.env.CLAUDE_PROJECT_DIR);
+        }
+        catch {
+            invalidClaudeProject = true;
+        }
+    }
+    return Object.freeze({ cwd: pin(process.cwd()), claudeProject, invalidClaudeProject,
+        // npm scripts execute in their package, not necessarily in the host workspace.
+        // This flag only disables launch authority; environment data never grant it.
+        indirectLaunch: Boolean(process.env.npm_lifecycle_event) });
+}
+async function canonical(value) {
+    if (!value.trim() || !path.isAbsolute(value))
+        throw new Error('Project root must be an absolute existing directory.');
+    const root = await fs.realpath(value).catch(() => null);
+    if (!root || !(await fs.stat(root).catch(() => null))?.isDirectory())
+        throw new Error('Project root is not an existing directory.');
+    return root;
+}
+async function recheck(root) {
+    if (await canonical(root.path) !== root.canonical)
+        throw new Error('PRODERO_ROOT_UNAUTHORIZED: Workspace boundary changed. Reconnect from the intended workspace.');
+    return root;
+}
+/** One lazy authority snapshot and selected root per tools/call, including Apps/plugins/text. */
+export function installWorkspaceBoundary(server, options) {
+    const fixed = options.projectRoot === undefined ? undefined : pin(options.projectRoot);
+    const launch = options.localStdio;
+    // Remember identities only to detect replacement; this map never grants access.
+    const hostIdentities = new Map();
+    const operations = new AsyncLocalStorage();
+    const register = server.server.setRequestHandler.bind(server.server);
+    server.server.setRequestHandler = (schema, handler) => register(schema, (request, extra) => request.method === 'tools/call' ? operations.run({}, () => handler(request, extra)) : handler(request, extra));
+    async function authority() {
+        if (fixed)
+            return { roots: [await recheck(fixed)], primary: fixed };
+        const client = server.server.getClientVersion()?.name;
+        const claude = client === 'claude-code';
+        if (server.server.getClientCapabilities()?.roots) {
+            let roots;
+            try {
+                roots = (await server.server.listRoots()).roots;
+            }
+            catch {
+                throw new Error('PRODERO_WORKSPACE_UNAVAILABLE: Cannot read MCP workspace roots. Reconnect the host.');
+            }
+            const unique = new Map();
+            try {
+                for (const { uri } of roots) {
+                    const url = new URL(uri);
+                    if (url.protocol !== 'file:')
+                        throw new Error();
+                    const value = path.resolve(fileURLToPath(url));
+                    const real = await canonical(value);
+                    const prior = hostIdentities.get(value);
+                    if (prior && prior.canonical !== real)
+                        throw new Error('Host root was replaced.');
+                    const root = prior ?? Object.freeze({ path: value, canonical: real });
+                    hostIdentities.set(value, root);
+                    if (!unique.has(real))
+                        unique.set(real, root);
+                }
+            }
+            catch {
+                throw new Error('PRODERO_WORKSPACE_UNAVAILABLE: MCP workspace roots must be file URIs for existing directories.');
+            }
+            // Empty/revoked/invalid negotiated roots never fall back to launch context.
+            if (!unique.size)
+                throw new Error('PRODERO_WORKSPACE_UNAVAILABLE: No MCP workspace roots are authorized by the host.');
+            let primary;
+            if (claude && launch?.invalidClaudeProject)
+                throw new Error('PRODERO_WORKSPACE_UNAVAILABLE: Invalid host project context. Reconnect the host.');
+            if (claude && launch?.claudeProject) {
+                await recheck(launch.claudeProject);
+                primary = unique.get(launch.claudeProject.canonical);
+                // Primary removal is legitimate revocation; never restore it through env.
+            }
+            return { roots: [...unique.values()], primary };
+        }
+        if (claude && launch?.claudeProject && !launch.invalidClaudeProject) {
+            const root = await recheck(launch.claudeProject);
+            return { roots: [root], primary: root };
+        }
+        if (client === 'codex-mcp-client' && launch && !launch.indirectLaunch) {
+            const root = await recheck(launch.cwd);
+            return { roots: [root], primary: root };
+        }
+        throw new Error('PRODERO_WORKSPACE_UNAVAILABLE: No trusted MCP workspace context. Use a supported local host and the direct Prodero launcher; reconnect after updating the integration.');
+    }
+    return async function workspaceRoot(explicit) {
+        const operation = operations.getStore();
+        if (!operation)
+            throw new Error('PRODERO_WORKSPACE_UNAVAILABLE: Project access requires an MCP operation context.');
+        const allowed = await (operation.authority ??= authority());
+        const selectedCanonical = explicit === undefined ? undefined : await canonical(explicit);
+        if (!operation.selected) {
+            operation.selected = (async () => {
+                const selected = selectedCanonical === undefined
+                    ? allowed.primary ?? (allowed.roots.length === 1 ? allowed.roots[0] : undefined)
+                    : allowed.roots.find(root => root.canonical === selectedCanonical);
+                if (!selected)
+                    throw new Error(selectedCanonical === undefined
+                        ? 'Missing or ambiguous MCP workspace roots. Select an authorized root with projectRoot.'
+                        : 'PRODERO_ROOT_UNAUTHORIZED: projectRoot is outside the host-authorized workspace boundary.');
+                await recheck(selected);
+                await explicitProjectRoot(selected.path);
+                return selected;
+            })();
+        }
+        const selected = await operation.selected;
+        if (selectedCanonical !== undefined && selectedCanonical !== selected.canonical)
+            throw new Error('PRODERO_ROOT_UNAUTHORIZED: An operation cannot switch workspace boundaries.');
+        await recheck(selected);
+        return selected.path;
+    };
+}
+//# sourceMappingURL=mcp-workspace.js.map