@reproapp/mcp 0.0.1

package/src/index.js

@@ -0,0 +1,3728 @@
+#!/usr/bin/env node
+'use strict';
+
+const childProcess = require('node:child_process');
+const fs = require('node:fs');
+const http = require('node:http');
+const os = require('node:os');
+const path = require('node:path');
+
+const SERVER_NAME = 'repro-mcp';
+const SERVER_VERSION = '0.0.1';
+const SUPPORTED_PROTOCOL_VERSION = '2024-11-05';
+const JSON_RPC_VERSION = '2.0';
+const DEFAULT_REPRO_AI_BASE_URL = 'http://10.116.0.4';
+const DEFAULT_REPRO_API_BASE_URL = 'http://10.116.0.5/api';
+const DEFAULT_REPRO_WEB_BASE_URL = 'https://getrepro.io';
+loadEnvironmentFiles(process.env);
+const DEBUG_LOG_PATH = process.env.REPRO_MCP_DEBUG_LOG;
+const DEFAULT_AUTH_TIMEOUT_MS = 2 * 60 * 1000;
+const DEFAULT_AUTH_POLL_INTERVAL_MS = 1500;
+const LOCAL_TOOL_DEFINITIONS = [
+  {
+    name: 'resolve_scope',
+    description:
+      'Resolve Repro scope for a high-level request. For app-only privacy questions, returns app policy context and Privacy Studio links without requiring the app to match the authenticated default app. For session-scoped debugging, delegates to the backend resolver.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        tenantId: { type: 'string' },
+        appId: { type: 'string' },
+        sessionId: { type: 'string' },
+        environment: { type: 'string' },
+        state: { type: 'string', enum: ['active', 'pending', 'approved'] },
+        query: { type: 'string' },
+        openUi: { type: 'boolean' },
+      },
+      additionalProperties: true,
+    },
+  },
+  {
+    name: 'check_privacy_coverage',
+    description:
+      'Answer high-level app privacy coverage questions across one or more apps, such as opaque-data coverage, without requiring users to know policy selectors, trace paths, or statement ids. Returns safe/needs-review/not-covered status and Privacy Studio links.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        tenantId: { type: 'string' },
+        appId: { type: 'string' },
+        appIds: {
+          type: 'array',
+          items: { type: 'string' },
+        },
+        environment: { type: 'string' },
+        state: { type: 'string', enum: ['active', 'pending', 'approved'] },
+        topic: { type: 'string' },
+        question: { type: 'string' },
+        includeTechnical: { type: 'boolean' },
+        openUi: { type: 'boolean' },
+      },
+      additionalProperties: true,
+    },
+  },
+  {
+    name: 'inspect_privacy_policy',
+    description:
+      'Inspect pending or approved privacy policy statements for an app/service, answer what policy covers a high-level topic, function, selector, target, code fragment, or all review blockers. Returns user-facing code/policy anchors first, flags real same-leaf contradictions, and returns Privacy Studio URLs for review.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        tenantId: { type: 'string' },
+        appId: { type: 'string' },
+        environment: { type: 'string' },
+        state: { type: 'string', enum: ['active', 'pending', 'approved'] },
+        query: { type: 'string' },
+        functionName: { type: 'string' },
+        selector: { type: 'string' },
+        target: { type: 'string' },
+        code: { type: 'string' },
+        includeTechnical: { type: 'boolean' },
+        openUi: { type: 'boolean' },
+      },
+      additionalProperties: true,
+    },
+  },
+  {
+    name: 'update_privacy_policy',
+    description:
+      'Find matching privacy policy statements from a high-level query or statement id, show a policy diff, and optionally stage/apply/approve changes. Prefer keep exact for known non-sensitive values or regex-assisted raw-text hints for sensitive formats; drop unsafe values; use safe partial mask only as a last-resort unknown-shape fallback.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        tenantId: { type: 'string' },
+        appId: { type: 'string' },
+        environment: { type: 'string' },
+        state: { type: 'string', enum: ['active', 'pending', 'approved'] },
+        query: { type: 'string' },
+        functionName: { type: 'string' },
+        selector: { type: 'string' },
+        target: { type: 'string' },
+        code: { type: 'string' },
+        statementSid: { type: 'string' },
+        statementSids: {
+          type: 'array',
+          items: { type: 'string' },
+        },
+        decision: {
+          type: 'string',
+          enum: ['SAFE_PARTIAL_MASK', 'KEEP_EXACT', 'DROP', 'REGEX_ASSISTED'],
+        },
+        rawTextHints: {
+          type: 'array',
+          items: {
+            type: 'object',
+            properties: {
+              name: { type: 'string' },
+              action: { type: 'string', enum: ['TOKENIZE', 'DROP'] },
+              regex: { type: 'string' },
+              tokenLabel: { type: 'string' },
+            },
+            additionalProperties: true,
+          },
+        },
+        apply: { type: 'boolean' },
+        approve: { type: 'boolean' },
+        allowMultiple: { type: 'boolean' },
+        openUi: { type: 'boolean' },
+      },
+      required: ['decision'],
+      additionalProperties: true,
+    },
+  },
+  {
+    name: 'approve_privacy_policy',
+    description:
+      'Approve the pending privacy policy for an app/environment through the Repro API validation path and return the updated policy state plus a Privacy Studio link.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        tenantId: { type: 'string' },
+        appId: { type: 'string' },
+        environment: { type: 'string' },
+        openUi: { type: 'boolean' },
+      },
+      additionalProperties: true,
+    },
+  },
+  {
+    name: 'privacy_audit_session',
+    description:
+      'Deterministically scan a session for privacy leaks and over-masked debugging values across requests, DB changes, and optionally traces.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        tenantId: { type: 'string' },
+        sessionId: { type: 'string' },
+        maxRequests: { type: 'number' },
+        maxDbChanges: { type: 'number' },
+        includeTraces: { type: 'boolean' },
+      },
+      required: ['sessionId'],
+      additionalProperties: true,
+    },
+  },
+];
+
+function loadConfig(env = process.env) {
+  const baseUrl = normalizeBaseUrl(env.REPRO_AI_BASE_URL || DEFAULT_REPRO_AI_BASE_URL);
+  const apiBaseUrl = normalizeOptionalBaseUrl(env.REPRO_API_BASE_URL, DEFAULT_REPRO_API_BASE_URL);
+  const publicApiBaseUrl = normalizeOptionalBaseUrl(env.REPRO_API_PUBLIC_BASE_URL, apiBaseUrl);
+  const webBaseUrl = normalizeOptionalBaseUrl(
+    env.REPRO_WEB_BASE_URL,
+    typeof env.REPRO_API_BASE_URL === 'string' && env.REPRO_API_BASE_URL.trim()
+      ? deriveWebBaseUrl(apiBaseUrl)
+      : DEFAULT_REPRO_WEB_BASE_URL,
+  );
+  const envAiToken = typeof env.REPRO_AI_TOKEN === 'string' && env.REPRO_AI_TOKEN.trim()
+    ? env.REPRO_AI_TOKEN.trim()
+    : undefined;
+  const envApiToken = typeof env.REPRO_API_TOKEN === 'string' && env.REPRO_API_TOKEN.trim()
+    ? env.REPRO_API_TOKEN.trim()
+    : undefined;
+  const authFilePath = resolveAuthFilePath(env.REPRO_MCP_AUTH_FILE);
+  const storedAuth = readStoredAuth(authFilePath, apiBaseUrl);
+  const token = envAiToken || storedAuth?.accessToken;
+  const apiToken = envApiToken || storedAuth?.accessToken;
+  const hasEnvDefaultTenant =
+    typeof env.REPRO_DEFAULT_TENANT_ID === 'string' && env.REPRO_DEFAULT_TENANT_ID.trim();
+  const defaultTenantId =
+    hasEnvDefaultTenant
+      ? env.REPRO_DEFAULT_TENANT_ID.trim()
+      : storedAuth?.tenantId
+        ? storedAuth.tenantId
+      : undefined;
+  const hasEnvDefaultApp =
+    typeof env.REPRO_APP_ID === 'string' && env.REPRO_APP_ID.trim();
+  const defaultAppId =
+    hasEnvDefaultApp
+      ? env.REPRO_APP_ID.trim()
+      : storedAuth?.appId
+        ? storedAuth.appId
+        : undefined;
+  const requestTimeoutMs = parsePositiveInteger(env.REPRO_REQUEST_TIMEOUT_MS, 30000);
+  const investigateTimeoutMs = parsePositiveInteger(
+    env.REPRO_INVESTIGATE_TIMEOUT_MS,
+    Math.max(requestTimeoutMs, 90000),
+  );
+  const authTimeoutMs = parsePositiveInteger(env.REPRO_MCP_AUTH_TIMEOUT_MS, DEFAULT_AUTH_TIMEOUT_MS);
+  const authPollIntervalMs = parsePositiveInteger(
+    env.REPRO_MCP_AUTH_POLL_INTERVAL_MS,
+    DEFAULT_AUTH_POLL_INTERVAL_MS,
+  );
+  const autoAuth =
+    typeof env.REPRO_MCP_AUTO_AUTH === 'string'
+      ? !['0', 'false', 'no', 'off'].includes(env.REPRO_MCP_AUTO_AUTH.trim().toLowerCase())
+      : true;
+  const clientName =
+    typeof env.REPRO_MCP_CLIENT_NAME === 'string' && env.REPRO_MCP_CLIENT_NAME.trim()
+      ? env.REPRO_MCP_CLIENT_NAME.trim()
+      : 'Codex';
+  const pathMappings = parsePathMappings(env.REPRO_PATH_MAPPINGS);
+  const transport = normalizeTransport(env.REPRO_MCP_TRANSPORT, env);
+  const authMode = normalizeAuthMode(env.REPRO_MCP_AUTH_MODE, transport);
+  const openBrowser = parseBoolean(
+    env.REPRO_MCP_OPEN_BROWSER,
+    transport !== 'http',
+    'REPRO_MCP_OPEN_BROWSER',
+  );
+  const httpHost =
+    typeof env.REPRO_MCP_HTTP_HOST === 'string' && env.REPRO_MCP_HTTP_HOST.trim()
+      ? env.REPRO_MCP_HTTP_HOST.trim()
+      : '0.0.0.0';
+  const httpPort = parsePositiveInteger(
+    env.REPRO_MCP_HTTP_PORT || env.PORT,
+    8080,
+  );
+  const httpPath = normalizeHttpPath(env.REPRO_MCP_HTTP_PATH);
+  const httpMaxBodyBytes = parsePositiveInteger(env.REPRO_MCP_HTTP_MAX_BODY_BYTES, 1024 * 1024);
+  const httpKeepAliveMs = parsePositiveInteger(env.REPRO_MCP_HTTP_KEEPALIVE_MS, 30000);
+  const corsOrigin =
+    typeof env.REPRO_MCP_CORS_ORIGIN === 'string' && env.REPRO_MCP_CORS_ORIGIN.trim()
+      ? env.REPRO_MCP_CORS_ORIGIN.trim()
+      : '*';
+
+  return {
+    baseUrl,
+    apiBaseUrl,
+    publicApiBaseUrl,
+    webBaseUrl,
+    token,
+    tokenSource: envAiToken ? 'env' : storedAuth?.accessToken ? 'file' : 'none',
+    apiToken,
+    apiTokenSource: envApiToken ? 'env' : storedAuth?.accessToken ? 'file' : 'none',
+    defaultTenantId,
+    defaultTenantIdSource: hasEnvDefaultTenant ? 'env' : storedAuth?.tenantId ? 'file' : 'none',
+    defaultAppId,
+    defaultAppIdSource: hasEnvDefaultApp ? 'env' : storedAuth?.appId ? 'file' : 'none',
+    requestTimeoutMs,
+    investigateTimeoutMs,
+    authFilePath,
+    authTimeoutMs,
+    authPollIntervalMs,
+    autoAuth,
+    clientName,
+    pathMappings,
+    transport,
+    authMode,
+    openBrowser,
+    httpHost,
+    httpPort,
+    httpPath,
+    httpMaxBodyBytes,
+    httpKeepAliveMs,
+    corsOrigin,
+  };
+}
+
+function normalizeBaseUrl(value) {
+  if (typeof value !== 'string' || !value.trim()) {
+    throw new Error('REPRO_AI_BASE_URL is required');
+  }
+
+  const trimmed = value.trim();
+  const normalized = trimmed.endsWith('/') ? trimmed : `${trimmed}/`;
+  return new URL(normalized).toString();
+}
+
+function normalizeTransport(value, env = process.env) {
+  if (typeof value !== 'string' || !value.trim()) {
+    return typeof env.PORT === 'string' && env.PORT.trim() ? 'http' : 'stdio';
+  }
+  const normalized = value.trim().toLowerCase();
+  if (normalized === 'stdio' || normalized === 'http') {
+    return normalized;
+  }
+  throw new Error(`Unsupported REPRO_MCP_TRANSPORT: ${value}`);
+}
+
+function normalizeAuthMode(value, transport) {
+  if (typeof value !== 'string' || !value.trim()) {
+    return transport === 'http' ? 'prompt' : 'wait';
+  }
+  const normalized = value.trim().toLowerCase();
+  if (normalized === 'prompt' || normalized === 'wait') {
+    return normalized;
+  }
+  throw new Error(`Unsupported REPRO_MCP_AUTH_MODE: ${value}`);
+}
+
+function normalizeHttpPath(value) {
+  if (typeof value !== 'string' || !value.trim()) {
+    return '/mcp';
+  }
+  const trimmed = value.trim();
+  return trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+}
+
+function loadEnvironmentFiles(env) {
+  const packageRoot = path.resolve(__dirname, '..');
+  const protectedKeys = new Set(Object.keys(env));
+  const explicitEnvFile =
+    typeof env.REPRO_MCP_ENV_FILE === 'string' && env.REPRO_MCP_ENV_FILE.trim()
+      ? path.resolve(env.REPRO_MCP_ENV_FILE.trim())
+      : null;
+  const envFiles = [
+    path.join(packageRoot, '.env'),
+    path.join(packageRoot, '.env.local'),
+  ];
+  if (explicitEnvFile) {
+    envFiles.push(explicitEnvFile);
+  }
+
+  for (const filePath of envFiles) {
+    loadEnvironmentFile(env, filePath, {
+      override: explicitEnvFile === filePath,
+      protectedKeys,
+    });
+  }
+}
+
+function loadEnvironmentFile(env, filePath, options = {}) {
+  let text;
+  try {
+    text = fs.readFileSync(filePath, 'utf8');
+  } catch {
+    return;
+  }
+
+  for (const rawLine of text.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith('#')) {
+      continue;
+    }
+    const equalsIndex = line.indexOf('=');
+    if (equalsIndex === -1) {
+      continue;
+    }
+    const key = line.slice(0, equalsIndex).trim();
+    const value = line.slice(equalsIndex + 1).trim();
+    if (!key) {
+      continue;
+    }
+    if (
+      Object.prototype.hasOwnProperty.call(env, key) &&
+      (!options.override || options.protectedKeys?.has(key))
+    ) {
+      continue;
+    }
+    env[key] = stripEnvQuotes(value);
+  }
+}
+
+function stripEnvQuotes(value) {
+  if (
+    (value.startsWith('"') && value.endsWith('"')) ||
+    (value.startsWith("'") && value.endsWith("'"))
+  ) {
+    return value.slice(1, -1);
+  }
+  return value;
+}
+
+function normalizeOptionalBaseUrl(value, fallback) {
+  if (typeof value === 'string' && value.trim()) {
+    return normalizeBaseUrl(value);
+  }
+  if (typeof fallback === 'string' && fallback.trim()) {
+    return normalizeBaseUrl(fallback);
+  }
+  return null;
+}
+
+function deriveWebBaseUrl(apiBaseUrl) {
+  if (typeof apiBaseUrl !== 'string' || !apiBaseUrl.trim()) {
+    return null;
+  }
+  try {
+    const url = new URL(apiBaseUrl);
+    url.pathname = url.pathname.replace(/\/api\/?$/, '/') || '/';
+    url.search = '';
+    url.hash = '';
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+
+function parsePositiveInteger(value, fallback) {
+  if (typeof value !== 'string' || !value.trim()) {
+    return fallback;
+  }
+
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`Invalid positive integer value: ${value}`);
+  }
+  return parsed;
+}
+
+function parseBoolean(value, fallback, label) {
+  if (typeof value !== 'string' || !value.trim()) {
+    return fallback;
+  }
+  const normalized = value.trim().toLowerCase();
+  if (['1', 'true', 'yes', 'on'].includes(normalized)) {
+    return true;
+  }
+  if (['0', 'false', 'no', 'off'].includes(normalized)) {
+    return false;
+  }
+  throw new Error(`Invalid boolean value for ${label}: ${value}`);
+}
+
+function parsePathMappings(value) {
+  if (typeof value !== 'string' || !value.trim()) {
+    return [];
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch (error) {
+    throw new Error(`REPRO_PATH_MAPPINGS must be valid JSON: ${error.message}`);
+  }
+
+  if (!Array.isArray(parsed)) {
+    throw new Error('REPRO_PATH_MAPPINGS must be an array');
+  }
+
+  return parsed.map((mapping, index) => {
+    if (!mapping || typeof mapping !== 'object') {
+      throw new Error(`REPRO_PATH_MAPPINGS[${index}] must be an object`);
+    }
+
+    const remotePrefix = normalizePrefix(mapping.remotePrefix, `REPRO_PATH_MAPPINGS[${index}].remotePrefix`);
+    const localPrefix = normalizePrefix(mapping.localPrefix, `REPRO_PATH_MAPPINGS[${index}].localPrefix`);
+    return {
+      remotePrefix,
+      localPrefix,
+    };
+  });
+}
+
+function normalizePrefix(value, label) {
+  if (typeof value !== 'string' || !value.trim()) {
+    throw new Error(`${label} is required`);
+  }
+
+  const trimmed = value.trim();
+  if (trimmed === path.sep) {
+    return trimmed;
+  }
+  return trimmed.replace(/[\\/]+$/, '');
+}
+
+function createReproAiClient(config, fetchImpl = globalThis.fetch, options = {}) {
+  if (typeof fetchImpl !== 'function') {
+    throw new Error('Global fetch is not available. Use Node.js 18 or newer.');
+  }
+
+  const authClient = createReproAuthClient(config, fetchImpl, options);
+
+  return {
+    async getToolCatalog() {
+      return requestJson(fetchImpl, config, 'v1/tools/catalog', {
+        method: 'GET',
+      });
+    },
+    async executeTool(name, input) {
+      if (!config.token && config.autoAuth) {
+        await authClient.ensureAuthenticated();
+      }
+
+      try {
+        return await requestJson(fetchImpl, config, 'v1/tools/execute', {
+          method: 'POST',
+          timeoutMs: name === 'investigate' ? config.investigateTimeoutMs : undefined,
+          body: {
+            name,
+            arguments: input,
+          },
+        });
+      } catch (error) {
+        if (shouldRetryWithInteractiveAuth(error, config)) {
+          clearPersistedAuth(config);
+          await authClient.ensureAuthenticated(true);
+          return requestJson(fetchImpl, config, 'v1/tools/execute', {
+            method: 'POST',
+            timeoutMs: name === 'investigate' ? config.investigateTimeoutMs : undefined,
+            body: {
+              name,
+              arguments: input,
+            },
+          });
+        }
+        throw error;
+      }
+    },
+    async requestApi(pathname, options = {}) {
+      if (!config.apiBaseUrl) {
+        throw new Error('REPRO_API_BASE_URL is required to inspect privacy policies');
+      }
+      if (!config.apiToken && config.autoAuth) {
+        await authClient.ensureAuthenticated();
+      }
+
+      try {
+        return await requestJson(fetchImpl, config, pathname, {
+          ...options,
+          baseUrl: config.apiBaseUrl,
+          token: config.apiToken,
+        });
+      } catch (error) {
+        if (shouldRetryApiWithInteractiveAuth(error, config)) {
+          clearPersistedAuth(config);
+          await authClient.ensureAuthenticated(true);
+          return requestJson(fetchImpl, config, pathname, {
+            ...options,
+            baseUrl: config.apiBaseUrl,
+            token: config.apiToken,
+          });
+        }
+        throw error;
+      }
+    },
+    ensureAuthenticated(force = false) {
+      return authClient.ensureAuthenticated(force);
+    },
+  };
+}
+
+async function requestJson(fetchImpl, config, pathname, options = {}) {
+  const baseUrl = normalizeBaseUrl(options.baseUrl || config.baseUrl);
+  const url = new URL(pathname, baseUrl);
+  const timeoutMs = positiveIntegerOrFallback(options.timeoutMs, config.requestTimeoutMs);
+  const headers = {
+    accept: 'application/json',
+  };
+  if (options.headers && typeof options.headers === 'object') {
+    for (const [key, value] of Object.entries(options.headers)) {
+      if (typeof value === 'string' && value.trim()) {
+        headers[key.toLowerCase()] = value.trim();
+      }
+    }
+  }
+  const hasExplicitToken = Object.prototype.hasOwnProperty.call(options, 'token');
+  const resolvedToken = hasExplicitToken
+    ? typeof options.token === 'string' && options.token.trim()
+      ? options.token.trim()
+      : ''
+    : config.token;
+  if (resolvedToken) {
+    headers.authorization = resolvedToken.startsWith('Bearer ')
+      ? resolvedToken
+      : `Bearer ${resolvedToken}`;
+  }
+  if (typeof options.body !== 'undefined') {
+    headers['content-type'] = 'application/json';
+  }
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    let response;
+    try {
+      response = await fetchImpl(url, {
+        method: options.method || 'GET',
+        headers,
+        body: typeof options.body === 'undefined' ? undefined : JSON.stringify(options.body),
+        signal: controller.signal,
+      });
+    } catch (error) {
+      if (controller.signal.aborted || error?.name === 'AbortError') {
+        throw new Error(`repro-ai request to ${url.toString()} timed out after ${timeoutMs}ms`);
+      }
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new Error(`Failed to reach repro-ai at ${url.toString()}: ${reason}`);
+    }
+    const text = await response.text();
+    let data = null;
+    if (text) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        throw new Error(`repro-ai returned non-JSON response (${response.status})`);
+      }
+    }
+
+    if (!response.ok) {
+      const message =
+        data && typeof data.error === 'string'
+          ? data.error
+          : `repro-ai request failed with status ${response.status}`;
+      const error = new Error(message);
+      error.statusCode = response.status;
+      error.details = data;
+      throw error;
+    }
+
+    return data;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function createReproAuthClient(config, fetchImpl, options = {}) {
+  const openUrlImpl = typeof options.openUrlImpl === 'function' ? options.openUrlImpl : openUrl;
+  const waitImpl = typeof options.waitImpl === 'function' ? options.waitImpl : wait;
+  let authPromise = null;
+  let promptSession = null;
+
+  return {
+    async ensureAuthenticated(force = false) {
+      if (!config.apiBaseUrl) {
+        throw new Error('REPRO_API_BASE_URL is required for interactive browser authentication');
+      }
+      if (config.apiToken && !force) {
+        return config.apiToken;
+      }
+      if (config.apiTokenSource === 'env' && force) {
+        throw new Error('REPRO_API_TOKEN is configured explicitly; fix or replace that token instead of starting interactive auth');
+      }
+      if (config.authMode === 'prompt') {
+        return ensurePromptAuthentication({
+          config,
+          fetchImpl,
+          force,
+          getPromptSession: () => promptSession,
+          setPromptSession: (value) => {
+            promptSession = value;
+          },
+        });
+      }
+      if (authPromise) {
+        return authPromise;
+      }
+
+      authPromise = (async () => {
+        const session = await createBrowserAuthSession(fetchImpl, config);
+
+        notifyUser(
+          `browser authentication required\nOpen: ${session.authorizeUrl}`,
+        );
+
+        if (config.openBrowser !== false) {
+          try {
+            await openUrlImpl(session.authorizeUrl);
+          } catch (error) {
+            debugLog(`failed to open browser automatically: ${error instanceof Error ? error.message : String(error)}`);
+          }
+        }
+
+        const pollIntervalMs = positiveIntegerOrFallback(
+          session.pollIntervalMs,
+          config.authPollIntervalMs,
+        );
+        const deadline = Date.now() + config.authTimeoutMs;
+
+        while (Date.now() < deadline) {
+          const claim = await claimBrowserAuthSession(fetchImpl, config, session);
+
+          if (claim && claim.status === 'pending') {
+            await waitImpl(pollIntervalMs);
+            continue;
+          }
+
+          if (claim && claim.status === 'approved' && typeof claim.accessToken === 'string') {
+            return completeBrowserAuth(config, claim);
+          }
+
+          if (claim && claim.status === 'claimed') {
+            throw new Error('The Repro MCP auth session was already claimed');
+          }
+
+          if (claim && claim.status === 'expired') {
+            throw new Error('The Repro MCP browser authentication session expired');
+          }
+
+          throw new Error('Unexpected response while completing Repro MCP authentication');
+        }
+
+        throw new Error('Timed out waiting for Repro browser authentication');
+      })().finally(() => {
+        authPromise = null;
+      });
+
+      return authPromise;
+    },
+  };
+}
+
+async function ensurePromptAuthentication({
+  config,
+  fetchImpl,
+  force,
+  getPromptSession,
+  setPromptSession,
+}) {
+  if (force) {
+    setPromptSession(null);
+  }
+
+  const existing = getPromptSession();
+  if (existing) {
+    const claim = await claimBrowserAuthSession(fetchImpl, config, existing);
+    if (claim && claim.status === 'approved' && typeof claim.accessToken === 'string') {
+      setPromptSession(null);
+      return completeBrowserAuth(config, claim);
+    }
+    if (claim && claim.status === 'pending') {
+      throw createBrowserAuthRequiredError(existing);
+    }
+    setPromptSession(null);
+  }
+
+  const session = await createBrowserAuthSession(fetchImpl, config);
+  setPromptSession(session);
+  notifyUser(`browser authentication required\nOpen: ${session.authorizeUrl}`);
+  throw createBrowserAuthRequiredError(session);
+}
+
+function createBrowserAuthSession(fetchImpl, config) {
+  return requestJson(fetchImpl, config, 'v1/mcp/auth/sessions', {
+    baseUrl: config.apiBaseUrl,
+    method: 'POST',
+    headers: buildBrowserAuthForwardHeaders(config),
+    body: {
+      clientName: config.clientName,
+    },
+    token: '',
+  });
+}
+
+function buildBrowserAuthForwardHeaders(config) {
+  const baseUrl = config.publicApiBaseUrl || config.apiBaseUrl;
+  if (typeof baseUrl !== 'string' || !baseUrl.trim()) {
+    return undefined;
+  }
+  try {
+    const url = new URL(baseUrl);
+    return {
+      'x-forwarded-proto': url.protocol.replace(/:$/, ''),
+      'x-forwarded-host': url.host,
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+function claimBrowserAuthSession(fetchImpl, config, session) {
+  return requestJson(fetchImpl, config, `v1/mcp/auth/sessions/${encodeURIComponent(session.sessionId)}/claim`, {
+    baseUrl: config.apiBaseUrl,
+    method: 'POST',
+    body: {
+      pollToken: session.pollToken,
+    },
+    token: '',
+  });
+}
+
+function completeBrowserAuth(config, claim) {
+  storeAuth(config, {
+    accessToken: claim.accessToken,
+    tenantId: typeof claim.tenantId === 'string' ? claim.tenantId : undefined,
+    appId: typeof claim.appId === 'string' ? claim.appId : undefined,
+    email: typeof claim.email === 'string' ? claim.email : undefined,
+    apiBaseUrl: config.apiBaseUrl,
+  });
+  notifyUser('browser authentication completed');
+  return config.apiToken;
+}
+
+function createBrowserAuthRequiredError(session) {
+  const error = new Error(
+    `Repro browser authentication required. Open ${session.authorizeUrl}, approve access, then retry the request.`,
+  );
+  error.rpcCode = -32001;
+  error.httpStatusCode = 200;
+  error.rpcData = {
+    type: 'browser_auth_required',
+    authorizeUrl: session.authorizeUrl,
+    sessionId: session.sessionId,
+    expiresAt: session.expiresAt,
+    retry: 'Approve this Repro MCP browser auth request, then retry the same MCP request.',
+  };
+  return error;
+}
+
+function shouldRetryWithInteractiveAuth(error, config) {
+  if (!config.autoAuth || !config.apiBaseUrl || config.tokenSource === 'env') {
+    return false;
+  }
+  const statusCode = error && typeof error === 'object' ? error.statusCode : null;
+  return statusCode === 401;
+}
+
+function shouldRetryApiWithInteractiveAuth(error, config) {
+  if (!config.autoAuth || !config.apiBaseUrl || config.apiTokenSource === 'env') {
+    return false;
+  }
+  const statusCode = error && typeof error === 'object' ? error.statusCode : null;
+  return statusCode === 401 || statusCode === 403;
+}
+
+function resolveAuthFilePath(value) {
+  if (typeof value === 'string' && value.trim()) {
+    return path.resolve(value.trim());
+  }
+  return path.join(os.homedir(), '.config', 'repro', 'repro-mcp-auth.json');
+}
+
+function readStoredAuth(filePath, apiBaseUrl) {
+  try {
+    const raw = fs.readFileSync(filePath, 'utf8');
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object') {
+      return null;
+    }
+    if (typeof parsed.accessToken !== 'string' || !parsed.accessToken.trim()) {
+      return null;
+    }
+    if (
+      typeof parsed.apiBaseUrl === 'string' &&
+      apiBaseUrl &&
+      normalizeBaseUrl(parsed.apiBaseUrl) !== normalizeBaseUrl(apiBaseUrl)
+    ) {
+      return null;
+    }
+    return {
+      accessToken: parsed.accessToken.trim(),
+      tenantId:
+        typeof parsed.tenantId === 'string' && parsed.tenantId.trim()
+          ? parsed.tenantId.trim()
+          : undefined,
+      appId:
+        typeof parsed.appId === 'string' && parsed.appId.trim()
+          ? parsed.appId.trim()
+          : undefined,
+      email:
+        typeof parsed.email === 'string' && parsed.email.trim()
+          ? parsed.email.trim()
+          : undefined,
+      apiBaseUrl:
+        typeof parsed.apiBaseUrl === 'string' && parsed.apiBaseUrl.trim()
+          ? normalizeBaseUrl(parsed.apiBaseUrl)
+          : undefined,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function storeAuth(config, auth) {
+  config.apiToken = auth.accessToken;
+  config.apiTokenSource = 'file';
+  if (config.tokenSource !== 'env') {
+    config.token = auth.accessToken;
+    config.tokenSource = 'file';
+  }
+  if (auth.tenantId && config.defaultTenantIdSource !== 'env') {
+    config.defaultTenantId = auth.tenantId;
+    config.defaultTenantIdSource = 'file';
+  }
+  if (auth.appId && config.defaultAppIdSource !== 'env') {
+    config.defaultAppId = auth.appId;
+    config.defaultAppIdSource = 'file';
+  }
+
+  try {
+    fs.mkdirSync(path.dirname(config.authFilePath), { recursive: true });
+    fs.writeFileSync(
+      config.authFilePath,
+      JSON.stringify(
+        {
+          accessToken: auth.accessToken,
+          tenantId: auth.tenantId || null,
+          appId: auth.appId || null,
+          email: auth.email || null,
+          apiBaseUrl: auth.apiBaseUrl || config.apiBaseUrl || null,
+          updatedAt: new Date().toISOString(),
+        },
+        null,
+        2,
+      ),
+      { mode: 0o600 },
+    );
+  } catch (error) {
+    debugLog(`failed to persist auth token: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+function clearPersistedAuth(config) {
+  if (config.tokenSource === 'file') {
+    config.token = undefined;
+    config.tokenSource = 'none';
+  }
+  if (config.apiTokenSource === 'file') {
+    config.apiToken = undefined;
+    config.apiTokenSource = 'none';
+  }
+
+  if (config.defaultTenantIdSource === 'file') {
+    config.defaultTenantId = undefined;
+    config.defaultTenantIdSource = 'none';
+  }
+  if (config.defaultAppIdSource === 'file') {
+    config.defaultAppId = undefined;
+    config.defaultAppIdSource = 'none';
+  }
+  try {
+    fs.rmSync(config.authFilePath, { force: true });
+  } catch (error) {
+    debugLog(`failed to remove stored auth token: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+function wait(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+async function openUrl(url) {
+  const command = resolveOpenCommand(url);
+  if (!command) {
+    return;
+  }
+
+  await new Promise((resolve, reject) => {
+    const child = childProcess.spawn(command[0], command.slice(1), {
+      detached: true,
+      stdio: 'ignore',
+    });
+    child.on('error', reject);
+    child.unref();
+    resolve();
+  });
+}
+
+function resolveOpenCommand(url) {
+  if (process.platform === 'darwin') {
+    return ['open', url];
+  }
+  if (process.platform === 'win32') {
+    return ['cmd', '/c', 'start', '', url];
+  }
+  if (process.platform === 'linux') {
+    return ['xdg-open', url];
+  }
+  return null;
+}
+
+function notifyUser(message) {
+  process.stderr.write(`[${SERVER_NAME}] ${message}\n`);
+}
+
+function positiveIntegerOrFallback(value, fallback) {
+  return Number.isFinite(value) && value > 0 ? Math.floor(value) : fallback;
+}
+
+function createMcpServer(config, options = {}) {
+  const client = options.client || createReproAiClient(config, options.fetchImpl, options);
+  let cachedTools = Array.isArray(options.initialTools) ? mergeLocalTools(options.initialTools.map(publicToolDefinition)) : null;
+  let cachedToolsComplete = Array.isArray(options.initialTools);
+
+  async function getTools(forceRefresh = false) {
+    if (!forceRefresh && cachedTools && cachedToolsComplete) {
+      return cachedTools;
+    }
+
+    try {
+      const catalog = await client.getToolCatalog();
+      const tools = mergeLocalTools(normalizeToolCatalog(catalog));
+      cachedTools = tools;
+      cachedToolsComplete = true;
+      return tools;
+    } catch (error) {
+      if (cachedTools && cachedToolsComplete) {
+        debugLog(
+          `catalog fetch failed, serving stale tools: ${error instanceof Error ? error.message : String(error)}`,
+        );
+        return cachedTools;
+      }
+      return mergeLocalTools([]);
+    }
+  }
+
+  return {
+    async handleMessage(message) {
+      return handleRpcMessage(message, config, client, getTools);
+    },
+    async getTools(forceRefresh = false) {
+      return getTools(forceRefresh);
+    },
+    async primeAuth() {
+      if (
+        !config.autoAuth ||
+        config.apiToken ||
+        !config.apiBaseUrl ||
+        typeof client.ensureAuthenticated !== 'function'
+      ) {
+        return null;
+      }
+      return client.ensureAuthenticated(false);
+    },
+  };
+}
+
+async function handleRpcMessage(message, config, client, getTools) {
+  if (!message || typeof message !== 'object') {
+    throw rpcError(-32600, 'Invalid Request');
+  }
+
+  const method = typeof message.method === 'string' ? message.method : null;
+  if (!method) {
+    throw rpcError(-32600, 'Invalid Request');
+  }
+  debugLog(
+    `recv method=${method} id=${Object.prototype.hasOwnProperty.call(message, 'id') ? String(message.id) : '-'} params=${summarizeForLog(message.params)}`,
+  );
+
+  if (method === 'notifications/initialized') {
+    return null;
+  }
+
+  if (method === 'initialize') {
+    const requestedProtocolVersion =
+      message.params &&
+      typeof message.params === 'object' &&
+      typeof message.params.protocolVersion === 'string' &&
+      message.params.protocolVersion.trim()
+        ? message.params.protocolVersion.trim()
+        : SUPPORTED_PROTOCOL_VERSION;
+    return {
+      jsonrpc: JSON_RPC_VERSION,
+      id: message.id,
+      result: {
+        protocolVersion: requestedProtocolVersion,
+        capabilities: {
+          tools: {},
+        },
+        serverInfo: {
+          name: SERVER_NAME,
+          version: SERVER_VERSION,
+        },
+      },
+    };
+  }
+
+  if (method === 'ping') {
+    return {
+      jsonrpc: JSON_RPC_VERSION,
+      id: message.id,
+      result: {},
+    };
+  }
+
+  if (method === 'tools/list') {
+    return {
+      jsonrpc: JSON_RPC_VERSION,
+      id: message.id,
+      result: {
+        tools: await getTools(),
+      },
+    };
+  }
+
+  if (method === 'tools/call') {
+    const params = message.params && typeof message.params === 'object' ? message.params : {};
+    const result = await executeTool(params, config, client, getTools);
+    return {
+      jsonrpc: JSON_RPC_VERSION,
+      id: message.id,
+      result,
+    };
+  }
+
+  throw rpcError(-32601, `Method not found: ${method}`);
+}
+
+function publicToolDefinition(tool) {
+  return {
+    name: tool.name,
+    description: tool.description,
+    inputSchema: tool.inputSchema,
+  };
+}
+
+function normalizeToolCatalog(catalog) {
+  if (!catalog || typeof catalog !== 'object' || !Array.isArray(catalog.tools)) {
+    throw new Error('repro-ai returned an invalid tool catalog');
+  }
+
+  return catalog.tools
+    .filter((tool) => tool && typeof tool === 'object')
+    .map(publicToolDefinition);
+}
+
+async function executeTool(params, config, client, getTools) {
+  const name = typeof params.name === 'string' ? params.name : '';
+  const rawArguments = normalizeToolArguments(params.arguments);
+  const input = prepareToolInput(rawArguments, config);
+
+  if (isLocalTool(name)) {
+    const response = await executeLocalTool(name, input, config, client);
+    const augmented = augmentPaths(response, config.pathMappings);
+    const isError =
+      augmented &&
+      typeof augmented === 'object' &&
+      ((augmented.status === 'error' || augmented.status === 'not_found') ||
+        Boolean(augmented.error));
+
+    return {
+      content: [
+        {
+          type: 'text',
+          text: formatLocalToolContentText(name, augmented),
+        },
+      ],
+      structuredContent: augmented,
+      isError,
+    };
+  }
+
+  let tools = await getTools();
+  let tool = tools.find((candidate) => candidate.name === name);
+  if (!tool) {
+    tools = await getTools(true);
+    tool = tools.find((candidate) => candidate.name === name);
+  }
+  if (!tool) {
+    throw rpcError(-32602, `Unknown tool: ${name}`);
+  }
+
+  const response = await client.executeTool(name, input);
+
+  const augmented = augmentPaths(response, config.pathMappings);
+  const isError =
+    augmented &&
+    typeof augmented === 'object' &&
+    ((augmented.status === 'error' || augmented.status === 'not_found') ||
+      Boolean(augmented.error));
+
+  return {
+    content: [
+      {
+        type: 'text',
+        text: formatLocalToolContentText(name, augmented),
+      },
+    ],
+    structuredContent: augmented,
+    isError,
+  };
+}
+
+function formatLocalToolContentText(name, value) {
+  if (name === 'inspect_privacy_policy') {
+    const text = renderPolicyInspectionText(value);
+    if (text) return text;
+  }
+  if (name === 'check_privacy_coverage') {
+    const text = renderPrivacyCoverageText(value);
+    if (text) return text;
+  }
+  return JSON.stringify(value, null, 2);
+}
+
+function mergeLocalTools(remoteTools) {
+  const byName = new Map();
+  for (const tool of LOCAL_TOOL_DEFINITIONS) {
+    byName.set(tool.name, publicToolDefinition(tool));
+  }
+  for (const tool of remoteTools) {
+    if (!byName.has(tool.name)) {
+      byName.set(tool.name, publicToolDefinition(tool));
+    }
+  }
+  return Array.from(byName.values());
+}
+
+function isLocalTool(name) {
+  return LOCAL_TOOL_DEFINITIONS.some((tool) => tool.name === name);
+}
+
+async function executeLocalTool(name, input, config, client) {
+  if (name === 'resolve_scope') {
+    return resolveScope(input, config, client);
+  }
+  if (name === 'check_privacy_coverage') {
+    return checkPrivacyCoverage(input, config, client);
+  }
+  if (name === 'inspect_privacy_policy') {
+    return inspectPrivacyPolicy(input, config, client);
+  }
+  if (name === 'update_privacy_policy') {
+    return updatePrivacyPolicy(input, config, client);
+  }
+  if (name === 'approve_privacy_policy') {
+    return approvePrivacyPolicy(input, config, client);
+  }
+  if (name === 'privacy_audit_session') {
+    return privacyAuditSession(input, config, client);
+  }
+  throw rpcError(-32602, `Unknown local tool: ${name}`);
+}
+
+async function resolveScope(input, config, client) {
+  if (!client || typeof client.requestApi !== 'function') {
+    throw rpcError(-32603, 'This MCP client cannot resolve app privacy scope');
+  }
+
+  const appId = optionalNonEmptyString(input.appId) || config.defaultAppId;
+  const sessionId = optionalNonEmptyString(input.sessionId);
+  if (appId && !sessionId) {
+    const requestedEnvironment = optionalNonEmptyString(input.environment);
+    const state = normalizePolicyState(input.state);
+    const query = optionalNonEmptyString(input.query) || '';
+    const privacyConfig = await client.requestApi(`v1/apps/${encodeURIComponent(appId)}/privacy`, {
+      method: 'GET',
+      headers: input.tenantId ? { 'x-tenant-id': input.tenantId } : undefined,
+    });
+    const environments = Array.isArray(privacyConfig?.environments) ? privacyConfig.environments : [];
+    const selection = selectPolicyForInspection(privacyConfig, requestedEnvironment, state);
+    const ui = buildPrivacyStudioUi(
+      config,
+      appId,
+      selection?.environmentId ?? requestedEnvironment,
+      query,
+      input.openUi === true,
+    );
+    if (ui.openRequested) {
+      try {
+        await openUrl(ui.url);
+        ui.opened = true;
+      } catch (error) {
+        ui.opened = false;
+        ui.openError = error instanceof Error ? error.message : String(error);
+      }
+    }
+    return {
+      status: selection ? 'ok' : 'not_found',
+      kind: 'app_privacy_scope',
+      appId,
+      tenantId: optionalNonEmptyString(input.tenantId) || config.defaultTenantId || null,
+      environment: selection?.environmentId ?? requestedEnvironment ?? null,
+      state: selection?.state ?? state,
+      summary: selection
+        ? 'Resolved app privacy scope. Use inspect_privacy_policy for read-only answers or update_privacy_policy for reviewed policy changes.'
+        : 'App was reachable, but no pending or approved privacy policy exists for the requested environment/state.',
+      ui,
+      environments: environments.map((environment) => ({
+        id: environment?.id,
+        hasPendingPolicy: Boolean(environment?.pendingPolicy?.policy),
+        hasApprovedPolicy: Boolean(environment?.approvedPolicy?.policy),
+      })),
+      tools: {
+        inspect: 'inspect_privacy_policy',
+        update: 'update_privacy_policy',
+        approve: 'approve_privacy_policy',
+      },
+    };
+  }
+
+  if (client && typeof client.executeTool === 'function') {
+    return client.executeTool('resolve_scope', input);
+  }
+  throw rpcError(-32602, 'appId or sessionId is required to resolve scope');
+}
+
+async function checkPrivacyCoverage(input, config, client) {
+  if (!client || typeof client.requestApi !== 'function') {
+    throw rpcError(-32603, 'This MCP client cannot fetch app privacy policies');
+  }
+  const appIds = normalizeCoverageAppIds(input, config);
+  const state = normalizePolicyState(input.state);
+  const requestedEnvironment = optionalNonEmptyString(input.environment);
+  const topic = normalizeCoverageTopic(input);
+  const query = queryForCoverageTopic(topic);
+  const includeTechnical = input.includeTechnical === true;
+  const results = [];
+
+  for (const appId of appIds) {
+    try {
+      const privacyConfig = await client.requestApi(`v1/apps/${encodeURIComponent(appId)}/privacy`, {
+        method: 'GET',
+        headers: input.tenantId ? { 'x-tenant-id': input.tenantId } : undefined,
+      });
+      const selection = selectPolicyForInspection(privacyConfig, requestedEnvironment, state);
+      if (!selection) {
+        results.push({
+          appId,
+          status: 'not_covered',
+          environment: requestedEnvironment ?? null,
+          state,
+          summary: 'No pending or approved privacy policy was found for this app/environment.',
+          ui: buildPrivacyStudioUi(config, appId, requestedEnvironment, query, false),
+          matches: [],
+          needsReviewReasons: ['No policy found.'],
+        });
+        continue;
+      }
+
+      const statements = flattenPrivacyStatements(selection.policy);
+      const blockerQuery = isPolicyBlockerQuery(query);
+      const matches = (blockerQuery
+        ? selectPolicyInspectionMatches(statements, { query }, query)
+        : rankPolicyStatementMatches(statements, { query }, query)
+      ).slice(0, blockerQuery ? 100 : 20);
+      const matchedStatements = matches.map((match) => match.statement);
+      const matchedLeaves = new Set(matches.flatMap((match) => statementTargetLeaves(match.statement)));
+      const contradictions = findSameLeafPolicyContradictions(statements, matchedLeaves);
+      const assessment = blockerQuery
+        ? assessPolicyBlockerCoverage(matchedStatements, contradictions)
+        : assessCoverage(matchedStatements, contradictions);
+      const evidence = buildCoverageEvidence(matchedStatements, contradictions, { includeTechnical });
+      const ui = buildPrivacyStudioUi(config, appId, selection.environmentId, query, input.openUi === true);
+      const policyBlockers = buildPolicyBlockerSummaries(
+        blockerQuery ? matchedStatements : matchedStatements.filter(isReviewBlockerStatement),
+        config,
+        appId,
+        selection.environmentId,
+        { includeTechnical },
+      );
+      if (ui.openRequested) {
+        try {
+          await openUrl(ui.url);
+          ui.opened = true;
+        } catch (error) {
+          ui.opened = false;
+          ui.openError = error instanceof Error ? error.message : String(error);
+        }
+      }
+
+      results.push({
+          appId,
+          environment: selection.environmentId,
+          state: selection.state,
+          inspectedPolicy: {
+            environment: selection.environmentId,
+            state: selection.state,
+            generatedAt: selection.record?.policy?.generatedAt ?? selection.record?.generatedAt ?? null,
+            totalStatementCount: statements.length,
+            matchedStatementCount: matchedStatements.length,
+          },
+          status: assessment.status,
+          summary: assessment.summary,
+          recommendation: coverageRecommendation(assessment.status, evidence),
+          ui,
+          protectedStatementCount: assessment.protectedStatementCount,
+          exactStatementCount: assessment.exactStatementCount,
+          unresolvedReviewCount: assessment.unresolvedReviewCount,
+	          coverage: evidence,
+	          contradictions,
+	          policyBlockers,
+	          matches: matches.map((match) => formatPolicyMatch(match.statement, match.score, { includeTechnical })),
+	          needsReviewReasons: assessment.reasons,
+      });
+    } catch (error) {
+      results.push({
+        appId,
+        status: 'error',
+        environment: requestedEnvironment ?? null,
+        state,
+        summary: error instanceof Error ? error.message : String(error),
+        ui: buildPrivacyStudioUi(config, appId, requestedEnvironment, query, false),
+        matches: [],
+        needsReviewReasons: ['Could not inspect policy because the API request failed.'],
+      });
+    }
+  }
+
+  const safe = results.filter((item) => item.status === 'safe').map((item) => item.appId);
+  const needsReview = results.filter((item) => item.status === 'needs_review').map((item) => item.appId);
+  const notCovered = results.filter((item) => item.status === 'not_covered').map((item) => item.appId);
+  const errors = results.filter((item) => item.status === 'error').map((item) => item.appId);
+
+  return {
+    status: errors.length ? 'warning' : needsReview.length || notCovered.length ? 'needs_review' : 'ok',
+    topic,
+    query,
+    inspected: {
+      requestedEnvironment: requestedEnvironment ?? null,
+      requestedState: state,
+      appCount: appIds.length,
+    },
+    summary: summarizeCoverageResults({ safe, needsReview, notCovered, errors }),
+    answerGuide: buildCoverageAnswerGuide(results),
+    safe,
+    needsReview,
+    notCovered,
+    errors,
+    results,
+  };
+}
+
+function normalizeCoverageAppIds(input, config) {
+  const appIds = [];
+  if (Array.isArray(input.appIds)) {
+    for (const appId of input.appIds) {
+      const normalized = optionalNonEmptyString(appId);
+      if (normalized) {
+        appIds.push(normalized);
+      }
+    }
+  }
+  const single = optionalNonEmptyString(input.appId);
+  if (single) {
+    appIds.push(single);
+  }
+  if (!appIds.length && config.defaultAppId) {
+    appIds.push(config.defaultAppId);
+  }
+  const unique = Array.from(new Set(appIds));
+  if (!unique.length) {
+    throw rpcError(-32602, 'appIds or appId is required unless REPRO_APP_ID or MCP browser auth provides a default app');
+  }
+  return unique;
+}
+
+function normalizeCoverageTopic(input) {
+  return optionalNonEmptyString(input.topic) || optionalNonEmptyString(input.question) || 'opaque data';
+}
+
+function queryForCoverageTopic(topic) {
+  if (/\bopaque\b|opaqueDiagnostic|opaqueTraceId|ZXQ/i.test(topic)) {
+    return 'opaque';
+  }
+  return topic;
+}
+
+function assessCoverage(statements, contradictions) {
+  const protectedStatements = statements.filter(isProtectivePolicyStatement);
+  const exactStatements = statements.filter(isExactPolicyStatement);
+  const unresolvedReviews = statements.filter((statement) => statement?.meta?.review?.status === 'REQUIRES_DECISION');
+  const reasons = [];
+
+  if (exactStatements.length > 0) {
+    reasons.push(`${exactStatements.length} matching statement(s) keep opaque-related data exact.`);
+  }
+  if (unresolvedReviews.length > 0) {
+    reasons.push(`${unresolvedReviews.length} matching raw-text review blocker(s) are unresolved.`);
+  }
+  if (contradictions.length > 0) {
+    reasons.push(`${contradictions.length} same-leaf contradiction(s) were found.`);
+  }
+  if (statements.length === 0) {
+    return {
+      status: 'not_covered',
+      summary: 'No opaque-related policy statements were found.',
+      protectedStatementCount: 0,
+      exactStatementCount: 0,
+      unresolvedReviewCount: 0,
+      reasons: ['No matching policy statements found.'],
+    };
+  }
+  if (reasons.length > 0 || protectedStatements.length === 0) {
+    if (protectedStatements.length === 0) {
+      reasons.push('No protective TOKENIZE, DROP, or regex-assisted raw-text policy matched.');
+    }
+    return {
+      status: 'needs_review',
+      summary: 'Opaque-related policy coverage needs review.',
+      protectedStatementCount: protectedStatements.length,
+      exactStatementCount: exactStatements.length,
+      unresolvedReviewCount: unresolvedReviews.length,
+      reasons,
+    };
+  }
+
+  return {
+    status: 'safe',
+    summary: 'Opaque-related policy coverage is protected by matching policy statements and has no exact-policy conflict.',
+    protectedStatementCount: protectedStatements.length,
+    exactStatementCount: 0,
+    unresolvedReviewCount: 0,
+    reasons,
+  };
+}
+
+function assessPolicyBlockerCoverage(statements, contradictions) {
+  const unresolvedReviews = statements.filter(isReviewBlockerStatement);
+  const reasons = [];
+  if (unresolvedReviews.length > 0) {
+    reasons.push(`${unresolvedReviews.length} unresolved privacy policy review blocker(s).`);
+  }
+  if (contradictions.length > 0) {
+    reasons.push(`${contradictions.length} same-leaf contradiction(s) were found.`);
+  }
+  if (!unresolvedReviews.length && !contradictions.length) {
+    return {
+      status: 'safe',
+      summary: 'No unresolved privacy policy review blockers were found.',
+      protectedStatementCount: statements.filter(isProtectivePolicyStatement).length,
+      exactStatementCount: statements.filter(isExactPolicyStatement).length,
+      unresolvedReviewCount: 0,
+      reasons: [],
+    };
+  }
+  return {
+    status: 'needs_review',
+    summary: 'Privacy policy has unresolved review blockers.',
+    protectedStatementCount: statements.filter(isProtectivePolicyStatement).length,
+    exactStatementCount: statements.filter(isExactPolicyStatement).length,
+    unresolvedReviewCount: unresolvedReviews.length,
+    reasons,
+  };
+}
+
+function buildCoverageEvidence(statements, contradictions, options = {}) {
+  const protectedStatements = statements.filter(isProtectivePolicyStatement);
+  const exactStatements = statements.filter(isExactPolicyStatement);
+  const unresolvedReviews = statements.filter((statement) => statement?.meta?.review?.status === 'REQUIRES_DECISION');
+  const relatedLeaves = Array.from(new Set(statements.flatMap(statementTargetLeaves))).sort();
+  const actions = {};
+  for (const statement of statements) {
+    const action = statement?.apply?.action ?? 'UNKNOWN';
+    actions[action] = (actions[action] ?? 0) + 1;
+  }
+
+  return {
+    relatedLeaves,
+    actionCounts: actions,
+    protectedBy: protectedStatements.slice(0, 8).map((statement) => formatCoverageStatement(statement, options)),
+    keptExact: exactStatements.slice(0, 8).map((statement) => formatCoverageStatement(statement, options)),
+    reviewBlockers: unresolvedReviews.slice(0, 8).map((statement) => formatCoverageStatement(statement, options)),
+    contradictionCount: contradictions.length,
+  };
+}
+
+function formatCoverageStatement(statement, options = {}) {
+  const descriptor = describePolicyStatement(statement);
+  const summary = {
+    label: descriptor.label,
+    codeAnchor: descriptor.codeAnchor,
+    kind: descriptor.kind,
+    selector: statement?.when?.selector,
+    action: statement?.apply?.action,
+    rawTextMode: statement?.apply?.rawTextMode,
+    descendantRawTextMode: statement?.apply?.descendantRawTextMode,
+    reviewStatus: statement?.meta?.review?.status,
+    reviewDecision: statement?.meta?.review?.decision,
+    targetSummary: descriptor.targetSummary,
+    reasoning: statement?.meta?.reasoning,
+  };
+  if (options.includeTechnical === true) {
+    summary.technical = {
+      statementSid: statement?.sid,
+    };
+  }
+  return summary;
+}
+
+function coverageRecommendation(status, evidence) {
+  if (status === 'safe') {
+    const leaves = evidence.relatedLeaves.length ? evidence.relatedLeaves.join(', ') : 'the requested opaque data';
+    return `Safe to approve for opaque coverage: ${leaves} is covered by protective policy and no matching exact-policy conflict was found.`;
+  }
+  if (status === 'not_covered') {
+    return 'Add a protective policy for opaque data before approval. Prefer TOKENIZE for direct opaque identifier leaves.';
+  }
+  if (evidence.keptExact.length > 0) {
+    return 'Review before approval: matching opaque-related policy keeps data exact. Change direct opaque leaves to TOKENIZE, unless this value is intentionally non-sensitive operational data.';
+  }
+  if (evidence.reviewBlockers.length > 0) {
+    return 'Resolve the matching raw-text review blockers before approval. Use regex-assisted handling only for raw/freeform text, not structured direct leaves.';
+  }
+  return 'Review before approval: matching opaque coverage is incomplete or contradictory.';
+}
+
+function buildCoverageAnswerGuide(results) {
+  const byStatus = (status) => results.filter((item) => item.status === status);
+  const formatLine = (item) => `${item.appId}: ${item.summary} UI: ${item.ui?.url ?? 'unavailable'}`;
+  const blockerLines = results.flatMap((item) =>
+    Array.isArray(item.policyBlockers)
+      ? item.policyBlockers.map((blocker) => {
+          const mode = blocker.currentPolicy.rawTextMode || blocker.currentPolicy.descendantRawTextMode || blocker.currentPolicy.action || 'UNKNOWN';
+          return `${item.appId} ${blocker.label}: current ${blocker.currentPolicy.action}${mode && mode !== blocker.currentPolicy.action ? ` / ${mode}` : ''}; recommendation ${blocker.recommendation || 'review'}; UI ${blocker.ui.url}`;
+        })
+      : [],
+  );
+  return {
+    lead: blockerLines.length
+      ? 'Report the inspected policy state/environment first, then list policy blockers by user-facing label/codeAnchor. Do not lead with field-* or function-* statement ids.'
+      : 'Report the inspected policy state/environment first, then group apps by Safe, Needs Review, Not Covered, and Errors. Include each app UI link.',
+    blockerLines,
+    safe: byStatus('safe').map(formatLine),
+    needsReview: byStatus('needs_review').map((item) =>
+      `${formatLine(item)} Reasons: ${(item.needsReviewReasons ?? []).join(' ') || 'Needs review.'}`,
+    ),
+    notCovered: byStatus('not_covered').map(formatLine),
+    errors: byStatus('error').map(formatLine),
+  };
+}
+
+function renderPolicyInspectionText(value) {
+  if (!value || typeof value !== 'object') return '';
+  const lines = [
+    `App: ${value.appId ?? 'unknown'}`,
+    `Environment: ${value.environment ?? 'unknown'}`,
+    `Policy state: ${value.state ?? 'unknown'}`,
+  ];
+  if (value.generatedAt) {
+    lines.push(`Generated: ${value.generatedAt}`);
+  }
+  if (value.summary) {
+    lines.push(`Summary: ${value.summary}`);
+  }
+  lines.push(`Privacy Studio: ${value.ui?.url ?? 'unavailable'}`);
+  const blockers = Array.isArray(value.policyBlockers) ? value.policyBlockers : [];
+  if (blockers.length > 0) {
+    lines.push('', `Policy Blockers (${blockers.length})`);
+    for (const blocker of blockers) {
+      lines.push(...renderPolicyBlockerTextLines(blocker));
+    }
+  }
+  if (Array.isArray(value.contradictions) && value.contradictions.length > 0) {
+    lines.push('', `Contradictions (${value.contradictions.length})`);
+    for (const contradiction of value.contradictions) {
+      lines.push(`- ${contradiction.message}`);
+    }
+  }
+  if (!blockers.length && Array.isArray(value.matches) && value.matches.length > 0) {
+    lines.push('', 'Matching Policies');
+    for (const match of value.matches.slice(0, 12)) {
+      lines.push(`- ${match.label || match.selector || 'policy'}: ${match.action || match.policy?.action || 'UNKNOWN'}${match.rawTextMode ? ` / ${match.rawTextMode}` : ''}`);
+    }
+  }
+  return lines.join('\n');
+}
+
+function renderPrivacyCoverageText(value) {
+  if (!value || typeof value !== 'object' || !Array.isArray(value.results)) return '';
+  const lines = [
+    `Summary: ${value.summary ?? 'privacy coverage inspected'}`,
+  ];
+  for (const result of value.results) {
+    lines.push(
+      '',
+      `App: ${result.appId ?? 'unknown'}`,
+      `Environment: ${result.environment ?? 'unknown'}`,
+      `Policy state: ${result.state ?? 'unknown'}`,
+      `Status: ${result.status ?? 'unknown'}`,
+    );
+    if (result.inspectedPolicy?.generatedAt) {
+      lines.push(`Generated: ${result.inspectedPolicy.generatedAt}`);
+    }
+    lines.push(`Privacy Studio: ${result.ui?.url ?? 'unavailable'}`);
+    const blockers = Array.isArray(result.policyBlockers) ? result.policyBlockers : [];
+    if (blockers.length > 0) {
+      lines.push('', `Policy Blockers (${blockers.length})`);
+      for (const blocker of blockers) {
+        lines.push(...renderPolicyBlockerTextLines(blocker));
+      }
+    }
+    if (Array.isArray(result.needsReviewReasons) && result.needsReviewReasons.length > 0 && blockers.length === 0) {
+      lines.push('', 'Needs Review Reasons');
+      for (const reason of result.needsReviewReasons) {
+        lines.push(`- ${reason}`);
+      }
+    }
+  }
+  return lines.join('\n');
+}
+
+function renderPolicyBlockerTextLines(blocker) {
+  const action = blocker?.currentPolicy?.action ?? 'UNKNOWN';
+  const mode = blocker?.currentPolicy?.rawTextMode || blocker?.currentPolicy?.descendantRawTextMode;
+  const choices = Array.isArray(blocker?.choices) && blocker.choices.length ? blocker.choices.join(', ') : 'none';
+  const surfaces = Array.isArray(blocker?.targetSummary?.surfaces) && blocker.targetSummary.surfaces.length
+    ? blocker.targetSummary.surfaces.join(', ')
+    : 'unknown surface';
+  return [
+    `- ${blocker?.label ?? 'policy blocker'}`,
+    `  codeAnchor: ${blocker?.codeAnchor ?? blocker?.technical?.selector ?? 'n/a'}`,
+    `  currentPolicy: ${action}${mode ? ` / ${mode}` : ''}`,
+    `  recommendation: ${blocker?.recommendation ?? 'review'}`,
+    `  choices: ${choices}`,
+    `  surfaces: ${surfaces}`,
+    `  reason: ${blocker?.reason ?? blocker?.reviewReason ?? 'n/a'}`,
+    `  UI: ${blocker?.ui?.url ?? 'unavailable'}`,
+  ];
+}
+
+function summarizeCoverageResults({ safe, needsReview, notCovered, errors }) {
+  return [
+    `${safe.length} safe`,
+    `${needsReview.length} need review`,
+    `${notCovered.length} not covered`,
+    `${errors.length} errors`,
+  ].join(', ');
+}
+
+async function inspectPrivacyPolicy(input, config, client) {
+  const appId = optionalNonEmptyString(input.appId) || config.defaultAppId;
+  if (!appId) {
+    throw rpcError(-32602, 'appId is required unless REPRO_APP_ID or MCP browser auth provides a default app');
+  }
+  if (!client || typeof client.requestApi !== 'function') {
+    throw rpcError(-32603, 'This MCP client cannot fetch app privacy policies');
+  }
+
+  const requestedEnvironment = optionalNonEmptyString(input.environment);
+  const state = normalizePolicyState(input.state);
+  const privacyConfig = await client.requestApi(`v1/apps/${encodeURIComponent(appId)}/privacy`, {
+    method: 'GET',
+    headers: input.tenantId ? { 'x-tenant-id': input.tenantId } : undefined,
+  });
+  const selection = selectPolicyForInspection(privacyConfig, requestedEnvironment, state);
+  if (!selection) {
+    return {
+      status: 'not_found',
+      appId,
+      environment: requestedEnvironment ?? null,
+      state,
+      message: 'No pending or approved privacy policy exists for the requested app/environment.',
+      ui: buildPrivacyStudioUi(config, appId, requestedEnvironment, policyInspectionQuery(input), input.openUi === true),
+    };
+  }
+
+  const statements = flattenPrivacyStatements(selection.policy);
+  const query = policyInspectionQuery(input);
+  const includeTechnical = input.includeTechnical === true;
+  const blockerQuery = isPolicyBlockerQuery(query);
+  const matches = selectPolicyInspectionMatches(statements, input, query).slice(0, blockerQuery ? 100 : 12);
+  const matchedLeaves = new Set(matches.flatMap((match) => statementTargetLeaves(match.statement)));
+  const contradictions = findSameLeafPolicyContradictions(statements, matchedLeaves);
+  const uiQuery = query || contradictions[0]?.leaf || '';
+  const ui = buildPrivacyStudioUi(config, appId, selection.environmentId, uiQuery, input.openUi === true);
+  const policyBlockers = buildPolicyBlockerSummaries(
+    blockerQuery ? matches.map((match) => match.statement) : matches.map((match) => match.statement).filter(isReviewBlockerStatement),
+    config,
+    appId,
+    selection.environmentId,
+    { includeTechnical },
+  );
+  if (ui.openRequested) {
+    try {
+      await openUrl(ui.url);
+      ui.opened = true;
+    } catch (error) {
+      ui.opened = false;
+      ui.openError = error instanceof Error ? error.message : String(error);
+    }
+  }
+
+  return {
+    status: 'ok',
+    appId,
+    environment: selection.environmentId,
+    state: selection.state,
+    generatedAt: selection.record?.policy?.generatedAt ?? selection.record?.generatedAt ?? null,
+    summary: summarizePolicyInspection(matches, contradictions, query, blockerQuery),
+    ui,
+    query: query || null,
+    answerGuide: buildPolicyInspectionAnswerGuide({
+      query,
+      blockerQuery,
+      policyBlockers,
+      contradictions,
+      ui,
+    }),
+    policyBlockers,
+    matches: matches.map((match) => formatPolicyMatch(match.statement, match.score, { includeTechnical })),
+    contradictions,
+    rawTextHints: summarizeRawTextHints(selection.policy, query),
+  };
+}
+
+async function updatePrivacyPolicy(input, config, client) {
+  const appId = optionalNonEmptyString(input.appId) || config.defaultAppId;
+  if (!appId) {
+    throw rpcError(-32602, 'appId is required unless REPRO_APP_ID or MCP browser auth provides a default app');
+  }
+  if (!client || typeof client.requestApi !== 'function') {
+    throw rpcError(-32603, 'This MCP client cannot fetch or update app privacy policies');
+  }
+
+  const requestedEnvironment = optionalNonEmptyString(input.environment);
+  const state = normalizePolicyState(input.state);
+  const decision = normalizePolicyUpdateDecision(input.decision);
+  const apply = input.apply === true;
+  const approve = input.approve === true;
+  const privacyConfig = await client.requestApi(`v1/apps/${encodeURIComponent(appId)}/privacy`, {
+    method: 'GET',
+    headers: input.tenantId ? { 'x-tenant-id': input.tenantId } : undefined,
+  });
+  const selection = selectPolicyForInspection(privacyConfig, requestedEnvironment, state);
+  if (!selection) {
+    return {
+      status: 'not_found',
+      appId,
+      environment: requestedEnvironment ?? null,
+      state,
+      summary: 'No pending or approved privacy policy exists for the requested app/environment.',
+      ui: buildPrivacyStudioUi(config, appId, requestedEnvironment, policyInspectionQuery(input), input.openUi === true),
+    };
+  }
+
+  const query = policyInspectionQuery(input);
+  const statements = flattenPrivacyStatements(selection.policy);
+  const selectedStatements = selectStatementsForPolicyUpdate(statements, input, query);
+  const explicitSelection = updateInputHasExplicitStatementSelection(input);
+  if (!selectedStatements.length) {
+    return {
+      status: 'not_found',
+      appId,
+      environment: selection.environmentId,
+      state: selection.state,
+      summary: 'No matching policy statements were found for the requested update.',
+      ui: buildPrivacyStudioUi(config, appId, selection.environmentId, query, input.openUi === true),
+      matches: rankPolicyStatementMatches(statements, input, query).slice(0, 8).map((match) => formatPolicyMatch(match.statement, match.score, { includeTechnical: true })),
+    };
+  }
+  if (apply && !explicitSelection && selectedStatements.length !== 1 && input.allowMultiple !== true) {
+    return {
+      status: 'needs_confirmation',
+      appId,
+      environment: selection.environmentId,
+      state: selection.state,
+      summary: `The query matched ${selectedStatements.length} statements. Pass statementSids or allowMultiple=true before applying.`,
+      ui: buildPrivacyStudioUi(config, appId, selection.environmentId, query, input.openUi === true),
+      matches: selectedStatements.map((statement) => formatPolicyMatch(statement, 0, { includeTechnical: true })),
+      proposed: buildPolicyUpdateDiff(selection.policy, selectedStatements, decision, input.rawTextHints),
+    };
+  }
+
+  const mutation = mutatePrivacyPolicy(selection.policy, selectedStatements, decision, input.rawTextHints);
+  const ui = buildPrivacyStudioUi(
+    config,
+    appId,
+    selection.environmentId,
+    query || selectedStatements[0]?.when?.selector || '',
+    input.openUi === true,
+  );
+  if (ui.openRequested) {
+    try {
+      await openUrl(ui.url);
+      ui.opened = true;
+    } catch (error) {
+      ui.opened = false;
+      ui.openError = error instanceof Error ? error.message : String(error);
+    }
+  }
+
+  if (!apply) {
+    return {
+      status: 'dry_run',
+      appId,
+      environment: selection.environmentId,
+      state: selection.state,
+      summary: `Prepared privacy policy update for ${selectedStatements.length} statement(s). No API write was made because apply=true was not set.`,
+      ui,
+      matches: selectedStatements.map((statement) => formatPolicyMatch(statement, 0, { includeTechnical: true })),
+      diff: mutation.diff,
+      nextStep: approve
+        ? 'Run again with apply=true to stage the update and approve=true to approve it after API validation.'
+        : 'Run again with apply=true to stage the pending policy update.',
+    };
+  }
+
+  const policyTarget = privacyPolicyTargetForApp(appId, selection.record, selection.policy);
+  const pendingConfig = await client.requestApi(
+    `v1/apps/${encodeURIComponent(appId)}/privacy/environments/${encodeURIComponent(selection.environmentId)}/policy`,
+    {
+      method: 'PUT',
+      headers: input.tenantId ? { 'x-tenant-id': input.tenantId } : undefined,
+      body: {
+        state: 'pending',
+        proposal: {
+          ...(selection.record?.proposal ?? {}),
+          target: policyTarget,
+        },
+        policy: {
+          ...mutation.policy,
+          sourceProposal: {
+            ...(mutation.policy?.sourceProposal ?? {}),
+            target: policyTarget,
+          },
+        },
+        policyContext: policyTarget,
+        branchPatterns: selection.environment?.branchPatterns,
+        deployOnMerge: selection.environment?.deployOnMerge,
+        source: selection.record?.source,
+      },
+    },
+  );
+
+  let approvedConfig = null;
+  if (approve) {
+    approvedConfig = await client.requestApi(
+      `v1/apps/${encodeURIComponent(appId)}/privacy/environments/${encodeURIComponent(selection.environmentId)}/pending/approve`,
+      {
+        method: 'POST',
+        headers: input.tenantId ? { 'x-tenant-id': input.tenantId } : undefined,
+      },
+    );
+  }
+
+  return {
+    status: approve ? 'approved' : 'pending',
+    appId,
+    environment: selection.environmentId,
+    previousState: selection.state,
+    summary: approve
+      ? `Updated and approved privacy policy for ${selectedStatements.length} statement(s).`
+      : `Staged pending privacy policy update for ${selectedStatements.length} statement(s).`,
+    ui,
+    diff: mutation.diff,
+    api: {
+      staged: true,
+      approved: approve,
+      pendingEnvironmentCount: Array.isArray(pendingConfig?.environments) ? pendingConfig.environments.length : undefined,
+      approvedEnvironmentCount: Array.isArray(approvedConfig?.environments) ? approvedConfig.environments.length : undefined,
+    },
+    restartRequired: true,
+  };
+}
+
+async function approvePrivacyPolicy(input, config, client) {
+  const appId = optionalNonEmptyString(input.appId) || config.defaultAppId;
+  if (!appId) {
+    throw rpcError(-32602, 'appId is required unless REPRO_APP_ID or MCP browser auth provides a default app');
+  }
+  if (!client || typeof client.requestApi !== 'function') {
+    throw rpcError(-32603, 'This MCP client cannot approve app privacy policies');
+  }
+
+  const requestedEnvironment = optionalNonEmptyString(input.environment);
+  const privacyConfig = await client.requestApi(`v1/apps/${encodeURIComponent(appId)}/privacy`, {
+    method: 'GET',
+    headers: input.tenantId ? { 'x-tenant-id': input.tenantId } : undefined,
+  });
+  const selection = selectPolicyForInspection(privacyConfig, requestedEnvironment, 'pending');
+  if (!selection) {
+    return {
+      status: 'not_found',
+      appId,
+      environment: requestedEnvironment ?? null,
+      summary: 'No pending privacy policy exists for the requested app/environment.',
+      ui: buildPrivacyStudioUi(config, appId, requestedEnvironment, '', input.openUi === true),
+    };
+  }
+  const approvedConfig = await client.requestApi(
+    `v1/apps/${encodeURIComponent(appId)}/privacy/environments/${encodeURIComponent(selection.environmentId)}/pending/approve`,
+    {
+      method: 'POST',
+      headers: input.tenantId ? { 'x-tenant-id': input.tenantId } : undefined,
+    },
+  );
+  return {
+    status: 'approved',
+    appId,
+    environment: selection.environmentId,
+    summary: 'Approved pending privacy policy through the Repro API validation path.',
+    ui: buildPrivacyStudioUi(config, appId, selection.environmentId, '', input.openUi === true),
+    api: {
+      approvedEnvironmentCount: Array.isArray(approvedConfig?.environments) ? approvedConfig.environments.length : undefined,
+    },
+    restartRequired: true,
+  };
+}
+
+function normalizePolicyState(value) {
+  const normalized = optionalNonEmptyString(value)?.toLowerCase();
+  if (normalized === 'pending' || normalized === 'approved') {
+    return normalized;
+  }
+  return 'active';
+}
+
+function selectPolicyForInspection(privacyConfig, requestedEnvironment, state) {
+  const environments = Array.isArray(privacyConfig?.environments) ? privacyConfig.environments : [];
+  const environment = requestedEnvironment
+    ? environments.find((candidate) => candidate?.id === requestedEnvironment)
+    : environments.find((candidate) => candidate?.pendingPolicy?.policy || candidate?.approvedPolicy?.policy);
+  if (!environment) {
+    return null;
+  }
+
+  let selectedState = state;
+  let record = null;
+  if (state === 'pending') {
+    record = environment.pendingPolicy;
+  } else if (state === 'approved') {
+    record = environment.approvedPolicy;
+  } else {
+    record = environment.pendingPolicy?.policy ? environment.pendingPolicy : environment.approvedPolicy;
+    selectedState = environment.pendingPolicy?.policy ? 'pending' : 'approved';
+  }
+  if (!record?.policy) {
+    return null;
+  }
+
+  return {
+    environmentId: environment.id,
+    environment,
+    state: selectedState,
+    record,
+    policy: record.policy,
+  };
+}
+
+function normalizePolicyUpdateDecision(value) {
+  const normalized = optionalNonEmptyString(value)?.toUpperCase();
+  if (
+    normalized === 'SAFE_PARTIAL_MASK' ||
+    normalized === 'KEEP_EXACT' ||
+    normalized === 'DROP' ||
+    normalized === 'REGEX_ASSISTED'
+  ) {
+    return normalized;
+  }
+  throw rpcError(-32602, 'decision must be KEEP_EXACT, REGEX_ASSISTED, DROP, or SAFE_PARTIAL_MASK. SAFE_PARTIAL_MASK is a last-resort unknown-shape fallback.');
+}
+
+function updateInputHasExplicitStatementSelection(input) {
+  return Boolean(
+    optionalNonEmptyString(input.statementSid) ||
+      (Array.isArray(input.statementSids) && input.statementSids.some((sid) => optionalNonEmptyString(sid))),
+  );
+}
+
+function selectStatementsForPolicyUpdate(statements, input, query) {
+  const explicitSids = new Set();
+  const single = optionalNonEmptyString(input.statementSid);
+  if (single) {
+    explicitSids.add(single);
+  }
+  if (Array.isArray(input.statementSids)) {
+    for (const sid of input.statementSids) {
+      const normalized = optionalNonEmptyString(sid);
+      if (normalized) {
+        explicitSids.add(normalized);
+      }
+    }
+  }
+  if (explicitSids.size) {
+    return statements.filter((statement) => explicitSids.has(String(statement?.sid ?? '')));
+  }
+
+  return rankPolicyStatementMatches(statements, input, query)
+    .slice(0, positiveIntegerOrFallback(input.maxMatches, input.allowMultiple === true ? 20 : 8))
+    .map((match) => match.statement);
+}
+
+function buildPolicyUpdateDiff(policy, statements, decision, rawTextHintsInput) {
+  return mutatePrivacyPolicy(policy, statements, decision, rawTextHintsInput).diff;
+}
+
+function mutatePrivacyPolicy(policy, selectedStatements, decision, rawTextHintsInput) {
+  const clonedPolicy = cloneJson(policy) ?? {};
+  const selectedSids = new Set(selectedStatements.map((statement) => String(statement?.sid ?? '')).filter(Boolean));
+  const existingHints = Array.isArray(clonedPolicy.rawTextHints) ? clonedPolicy.rawTextHints : [];
+  const hintPlan = normalizePolicyUpdateRawTextHints(rawTextHintsInput);
+  const hintMutation = decision === 'REGEX_ASSISTED'
+    ? mergePolicyRawTextHints(existingHints, hintPlan, selectedStatements)
+    : { hints: existingHints, namesByStatementSid: new Map(), changes: [] };
+  clonedPolicy.rawTextHints = hintMutation.hints;
+
+  const beforeBySid = new Map(selectedStatements.map((statement) => [String(statement?.sid ?? ''), formatPolicyStatementSummary(statement)]));
+  const afterBySid = new Map();
+  replacePolicyStatements(clonedPolicy, (statement) => {
+    if (!selectedSids.has(String(statement?.sid ?? ''))) {
+      return statement;
+    }
+    const hintNames = hintMutation.namesByStatementSid.get(String(statement?.sid ?? '')) ?? [];
+    const next = updatePolicyStatementForDecision(statement, decision, hintNames);
+    afterBySid.set(String(statement?.sid ?? ''), formatPolicyStatementSummary(next));
+    return next;
+  });
+
+  return {
+    policy: clonedPolicy,
+    diff: {
+      decision,
+      affectedStatementCount: selectedSids.size,
+      statements: Array.from(selectedSids).map((sid) => ({
+        sid,
+        before: beforeBySid.get(sid),
+        after: afterBySid.get(sid),
+      })),
+      rawTextHints: hintMutation.changes,
+    },
+  };
+}
+
+function replacePolicyStatements(policy, updater) {
+  if (Array.isArray(policy.groups)) {
+    policy.groups = policy.groups.map((group) => ({
+      ...group,
+      statements: Array.isArray(group?.statements)
+        ? group.statements.map((statement) => updater(statement))
+        : group?.statements,
+    }));
+  }
+  if (Array.isArray(policy.statements)) {
+    policy.statements = policy.statements.map((statement) => updater(statement));
+  }
+  return policy;
+}
+
+function updatePolicyStatementForDecision(statement, decision, rawTextHintNames) {
+  const next = cloneJson(statement) ?? {};
+  next.apply = { ...(next.apply ?? {}) };
+  const structured = decisionAppliesToStructuredContainer(next);
+  delete next.apply.rawTextMode;
+  delete next.apply.descendantRawTextMode;
+  delete next.apply.textPolicy;
+
+  if (decision === 'KEEP_EXACT') {
+    next.apply.action = 'KEEP_EXACT';
+    next.apply.synthetic = false;
+    next.meta = updatePolicyStatementReview(next.meta, 'KEEP_RAW', undefined);
+    return next;
+  }
+  if (decision === 'DROP') {
+    next.apply.action = 'DROP';
+    next.apply.synthetic = true;
+    next.meta = updatePolicyStatementReview(next.meta, 'SAFE_DROP', undefined);
+    return next;
+  }
+  if (decision === 'SAFE_PARTIAL_MASK') {
+    if (structured) {
+      next.apply.action = 'KEEP_EXACT';
+      next.apply.synthetic = true;
+      next.apply.descendantRawTextMode = 'SAFE_PARTIAL_MASK';
+    } else {
+      next.apply.action = 'SUMMARIZE';
+      next.apply.synthetic = true;
+      next.apply.rawTextMode = 'SAFE_PARTIAL_MASK';
+    }
+    next.meta = updatePolicyStatementReview(next.meta, 'SAFE_PARTIAL_MASK', undefined);
+    return next;
+  }
+
+  if (!rawTextHintNames.length) {
+    throw rpcError(-32602, 'REGEX_ASSISTED updates require at least one rawTextHints entry or an existing bound hint');
+  }
+  if (structured) {
+    next.apply.action = 'KEEP_EXACT';
+    next.apply.synthetic = true;
+    next.apply.descendantRawTextMode = 'REGEX_ASSISTED_EXACT';
+  } else {
+    next.apply.action = 'SUMMARIZE';
+    next.apply.synthetic = true;
+    next.apply.rawTextMode = 'REGEX_ASSISTED_EXACT';
+  }
+  next.meta = updatePolicyStatementReview(next.meta, 'REGEX_ASSISTED', rawTextHintNames);
+  return next;
+}
+
+function decisionAppliesToStructuredContainer(statement) {
+  const reviewChoices = Array.isArray(statement?.meta?.review?.choices)
+    ? statement.meta.review.choices
+    : [];
+  if (reviewChoices.includes('SAFE_DROP')) {
+    return false;
+  }
+  if (reviewChoices.length) {
+    return true;
+  }
+  if (statement?.apply?.descendantRawTextMode) {
+    return true;
+  }
+  if (statement?.apply?.rawTextMode) {
+    return false;
+  }
+  const targetParts = splitPolicyTargetParts(statement?.when?.target);
+  if (targetParts.length) {
+    return targetParts.some((part) =>
+      /(?:^|\.)(?:metadata|payload|providerPayload|rawPayload|data(?:\[\])?|doc|docs\[\]|result|results\[\]|items\[\]|records\[\]|body|headers|query|params|args)$/.test(part),
+    );
+  }
+  const selector = String(statement?.when?.selector ?? '').toLowerCase();
+  return /\b(?:payload|body|data|doc|args|providerresponse|envelope|messages|records|items|result|results|metadata)\b/.test(selector);
+}
+
+function updatePolicyStatementReview(meta, decision, rawTextHintNames) {
+  const nextMeta = { ...(meta ?? {}) };
+  const previousReview = nextMeta.review && typeof nextMeta.review === 'object' ? nextMeta.review : null;
+  nextMeta.review = {
+    kind: 'UNSTRUCTURED_DATA',
+    status: 'RESOLVED',
+    recommendation: 'REGEX_ASSISTED',
+    reasoning:
+      previousReview?.reasoning ??
+      'Updated through Repro MCP policy review.',
+    choices: Array.isArray(previousReview?.choices) && previousReview.choices.length
+      ? previousReview.choices
+      : ['REGEX_ASSISTED', 'KEEP_RAW', 'SAFE_DROP', 'SAFE_PARTIAL_MASK'],
+    ...previousReview,
+    status: 'RESOLVED',
+    decision,
+    rawTextHintNames: decision === 'REGEX_ASSISTED' && rawTextHintNames?.length
+      ? mergeUniqueStrings(rawTextHintNames)
+      : undefined,
+  };
+  return nextMeta;
+}
+
+function normalizePolicyUpdateRawTextHints(input) {
+  if (typeof input === 'undefined' || input === null) {
+    return [];
+  }
+  if (!Array.isArray(input)) {
+    throw rpcError(-32602, 'rawTextHints must be an array when provided');
+  }
+  return input.map((hint, index) => normalizePolicyUpdateRawTextHint(hint, index));
+}
+
+function normalizePolicyUpdateRawTextHint(input, index) {
+  if (!input || typeof input !== 'object') {
+    throw rpcError(-32602, `rawTextHints[${index}] must be an object`);
+  }
+  const regex = requireNonEmptyString(input.regex, `rawTextHints[${index}].regex`);
+  try {
+    new RegExp(regex);
+  } catch (error) {
+    throw rpcError(-32602, `rawTextHints[${index}].regex is invalid: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const action = optionalNonEmptyString(input.action)?.toUpperCase() || 'TOKENIZE';
+  if (action !== 'TOKENIZE' && action !== 'DROP') {
+    throw rpcError(-32602, `rawTextHints[${index}].action must be TOKENIZE or DROP`);
+  }
+  return {
+    name: optionalNonEmptyString(input.name),
+    scope: 'RAW_TEXT_ONLY',
+    action,
+    regex,
+    tokenLabel: optionalNonEmptyString(input.tokenLabel),
+  };
+}
+
+function mergePolicyRawTextHints(existingHints, hintPlan, selectedStatements) {
+  const nextHints = existingHints.map((hint) => ({ ...hint }));
+  const changes = [];
+  const namesByStatementSid = new Map();
+  const existingNamesByStatement = new Map(
+    selectedStatements.map((statement) => [
+      String(statement?.sid ?? ''),
+      mergeUniqueStrings(Array.isArray(statement?.meta?.review?.rawTextHintNames) ? statement.meta.review.rawTextHintNames : []),
+    ]),
+  );
+
+  for (const statement of selectedStatements) {
+    const sid = String(statement?.sid ?? '');
+    const names = [...(existingNamesByStatement.get(sid) ?? [])];
+    for (const planned of hintPlan) {
+      const hint = {
+        ...planned,
+        name: uniqueRawTextHintName(
+          planned.name || defaultRawTextHintName(statement, planned),
+          planned,
+          nextHints,
+        ),
+      };
+      const existingIndex = nextHints.findIndex((candidate) => candidate?.name === hint.name);
+      if (existingIndex >= 0 && rawTextHintEquivalent(nextHints[existingIndex], hint)) {
+        changes.push({ type: 'reused', name: hint.name, action: hint.action, tokenLabel: hint.tokenLabel, regex: hint.regex });
+      } else if (existingIndex >= 0) {
+        nextHints[existingIndex] = hint;
+        changes.push({ type: 'updated', name: hint.name, action: hint.action, tokenLabel: hint.tokenLabel, regex: hint.regex });
+      } else {
+        nextHints.push(hint);
+        changes.push({ type: 'added', name: hint.name, action: hint.action, tokenLabel: hint.tokenLabel, regex: hint.regex });
+      }
+      names.push(hint.name);
+    }
+    namesByStatementSid.set(sid, mergeUniqueStrings(names));
+  }
+
+  for (const statement of selectedStatements) {
+    const sid = String(statement?.sid ?? '');
+    if (!namesByStatementSid.has(sid)) {
+      namesByStatementSid.set(sid, mergeUniqueStrings(existingNamesByStatement.get(sid) ?? []));
+    }
+  }
+  return {
+    hints: nextHints,
+    namesByStatementSid,
+    changes,
+  };
+}
+
+function uniqueRawTextHintName(baseName, hint, existingHints) {
+  const normalizedBase = optionalNonEmptyString(baseName) || 'Raw text detector';
+  const sameName = existingHints.find((candidate) => candidate?.name === normalizedBase);
+  if (!sameName || rawTextHintEquivalent(sameName, { ...hint, name: normalizedBase })) {
+    return normalizedBase;
+  }
+  const actionSuffix = hint.action === 'DROP' ? 'drop' : 'tokenize';
+  const labelSuffix = optionalNonEmptyString(hint.tokenLabel) || 'match';
+  let index = 2;
+  let candidateName = `${normalizedBase} ${labelSuffix} ${actionSuffix}`;
+  while (existingHints.some((candidate) => candidate?.name === candidateName && !rawTextHintEquivalent(candidate, { ...hint, name: candidateName }))) {
+    candidateName = `${normalizedBase} ${labelSuffix} ${actionSuffix} ${index}`;
+    index += 1;
+  }
+  return candidateName;
+}
+
+function rawTextHintEquivalent(left, right) {
+  return (
+    left?.scope === 'RAW_TEXT_ONLY' &&
+    right?.scope === 'RAW_TEXT_ONLY' &&
+    left?.action === right?.action &&
+    String(left?.regex ?? '') === String(right?.regex ?? '') &&
+    String(left?.tokenLabel ?? '') === String(right?.tokenLabel ?? '')
+  );
+}
+
+function defaultRawTextHintName(statement, hint) {
+  const selector = optionalNonEmptyString(statement?.when?.selector) || 'raw text';
+  const leaf = selector.split('|')[0].split('.').filter(Boolean).pop() || 'raw text';
+  const label = humanizePolicyLabel(optionalNonEmptyString(hint.tokenLabel) || leaf);
+  return `${humanizePolicyLabel(leaf)} ${label} detector`;
+}
+
+function humanizePolicyLabel(value) {
+  return String(value ?? '')
+    .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+    .replace(/[_\-.]+/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .replace(/\b\w/g, (letter) => letter.toUpperCase()) || 'Raw Text';
+}
+
+function mergeUniqueStrings(values) {
+  const output = [];
+  const seen = new Set();
+  for (const value of values ?? []) {
+    const normalized = optionalNonEmptyString(value);
+    if (!normalized || seen.has(normalized)) {
+      continue;
+    }
+    seen.add(normalized);
+    output.push(normalized);
+  }
+  return output;
+}
+
+function privacyPolicyTargetForApp(appId, record, policy) {
+  const target =
+    record?.proposal?.target ??
+    policy?.sourceProposal?.target ??
+    {};
+  return {
+    ...target,
+    appId,
+  };
+}
+
+function cloneJson(value) {
+  if (typeof value === 'undefined') {
+    return undefined;
+  }
+  return JSON.parse(JSON.stringify(value));
+}
+
+function policyInspectionQuery(input) {
+  return [
+    optionalNonEmptyString(input.query),
+    optionalNonEmptyString(input.functionName),
+    optionalNonEmptyString(input.selector),
+    optionalNonEmptyString(input.target),
+  ].find(Boolean) || codeInspectionQuery(input.code) || '';
+}
+
+function codeInspectionQuery(code) {
+  const value = optionalNonEmptyString(code);
+  if (!value) {
+    return '';
+  }
+  const functionMatch = value.match(/\b(?:async\s+)?(?:function\s+)?([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/);
+  if (functionMatch?.[1]) {
+    return functionMatch[1];
+  }
+  const methodMatch = value.match(/\b([A-Za-z_$][A-Za-z0-9_$]*)\s*[:=]\s*(?:async\s*)?\(/);
+  if (methodMatch?.[1]) {
+    return methodMatch[1];
+  }
+  return value.slice(0, 120);
+}
+
+function flattenPrivacyStatements(policy) {
+  if (!policy || typeof policy !== 'object') {
+    return [];
+  }
+  if (Array.isArray(policy.statements)) {
+    return policy.statements.filter(Boolean);
+  }
+  if (!Array.isArray(policy.groups)) {
+    return [];
+  }
+  return policy.groups.flatMap((group) => Array.isArray(group?.statements) ? group.statements.filter(Boolean) : []);
+}
+
+function rankPolicyStatementMatches(statements, input, query) {
+  const queryTokens = tokenizePolicySearch(query);
+  const codeTokens = tokenizePolicySearch(optionalNonEmptyString(input.code) || '').slice(0, 20);
+  const selector = optionalNonEmptyString(input.selector)?.toLowerCase();
+  const target = optionalNonEmptyString(input.target)?.toLowerCase();
+  const functionName = optionalNonEmptyString(input.functionName)?.toLowerCase();
+
+  return statements
+    .map((statement) => {
+      const haystack = policyStatementHaystack(statement);
+      let score = 0;
+      if (!queryTokens.length && !selector && !target && !functionName && !codeTokens.length) {
+        score = 1;
+      }
+      if (query && haystack.includes(query.toLowerCase())) score += 5;
+      if (selector && haystack.includes(selector)) score += 6;
+      if (target && haystack.includes(target)) score += 6;
+      if (functionName && haystack.includes(functionName)) score += 8;
+      for (const token of queryTokens) {
+        if (haystack.includes(token)) score += 2;
+      }
+      let codeHits = 0;
+      for (const token of codeTokens) {
+        if (haystack.includes(token)) codeHits += 1;
+      }
+      score += Math.min(codeHits, 5);
+      return { statement, score };
+    })
+    .filter((match) => match.score > 0)
+    .sort((left, right) => right.score - left.score || statementSortKey(left.statement).localeCompare(statementSortKey(right.statement)));
+}
+
+function selectPolicyInspectionMatches(statements, input, query) {
+  if (!isPolicyBlockerQuery(query)) {
+    return rankPolicyStatementMatches(statements, input, query);
+  }
+
+  const blockers = statements.filter(isReviewBlockerStatement);
+  if (isAllPolicyBlockersQuery(query)) {
+    return blockers.map((statement, index) => ({ statement, score: 1000 - index }));
+  }
+
+  const rankedBlockers = rankPolicyStatementMatches(blockers, input, query);
+  if (rankedBlockers.length > 0) {
+    return rankedBlockers;
+  }
+  return blockers.map((statement, index) => ({ statement, score: 1000 - index }));
+}
+
+function isPolicyBlockerQuery(query) {
+  const normalized = typeof query === 'string' ? query.toLowerCase() : '';
+  return /\b(blocker|blockers|blocking|needs?\s+review|review\s+blockers?|review\s+decisions?|approval\s+blockers?|unresolved|requires?\s+decision)\b/i.test(normalized);
+}
+
+function isAllPolicyBlockersQuery(query) {
+  const normalized = typeof query === 'string' ? query.toLowerCase() : '';
+  return /\b(all|every|list|return|show)\b/.test(normalized) && /\b(blocker|blockers|blocking|review\s+blockers?|approval\s+blockers?)\b/.test(normalized);
+}
+
+function isReviewBlockerStatement(statement) {
+  return statement?.meta?.review?.status === 'REQUIRES_DECISION';
+}
+
+function policyStatementHaystack(statement) {
+  return [
+    statement?.sid,
+    statement?.when?.scope,
+    statement?.when?.selector,
+    statement?.when?.target,
+    statement?.when?.pattern,
+    statement?.apply?.action,
+    statement?.apply?.rawTextMode,
+    statement?.apply?.descendantRawTextMode,
+    statement?.meta?.reasoning,
+    statement?.meta?.review?.status,
+    statement?.meta?.review?.decision,
+    Array.isArray(statement?.meta?.review?.rawTextHintNames)
+      ? statement.meta.review.rawTextHintNames.join(' ')
+      : '',
+  ].filter(Boolean).join(' ').toLowerCase();
+}
+
+function tokenizePolicySearch(value) {
+  const text = typeof value === 'string' ? value : '';
+  return Array.from(new Set(
+    text
+      .toLowerCase()
+      .split(/[^a-z0-9_]+/)
+      .map((token) => token.trim())
+      .filter((token) => token.length >= 3),
+  ));
+}
+
+function findSameLeafPolicyContradictions(statements, matchedLeaves) {
+  const groups = new Map();
+  for (const statement of statements) {
+    if (statement?.when?.scope !== 'FIELD') {
+      continue;
+    }
+    for (const leaf of statementTargetLeaves(statement)) {
+      if (isStructuralPolicyLeaf(leaf)) {
+        continue;
+      }
+      if (isSafeOperationalPolicyLeaf(leaf)) {
+        continue;
+      }
+      if (matchedLeaves.size > 0 && !matchedLeaves.has(leaf)) {
+        continue;
+      }
+      const group = groups.get(leaf) ?? { leaf, protective: [], exact: [] };
+      if (isProtectivePolicyStatement(statement)) {
+        group.protective.push(statement);
+      }
+      if (isExactPolicyStatement(statement)) {
+        group.exact.push(statement);
+      }
+      groups.set(leaf, group);
+    }
+  }
+
+  return Array.from(groups.values())
+    .filter((group) => group.protective.length > 0 && group.exact.length > 0)
+    .map((group) => ({
+      leaf: group.leaf,
+      severity: 'warning',
+      message: `Same leaf ${group.leaf} has both protective and KEEP_EXACT policies. The exact copy can bypass raw-text hints on copied runtime surfaces.`,
+      protective: group.protective.slice(0, 5).map(formatPolicyStatementSummary),
+      exact: group.exact.slice(0, 5).map(formatPolicyStatementSummary),
+    }));
+}
+
+function statementTargetLeaves(statement) {
+  return splitPolicyTargetParts(statement?.when?.target)
+    .map(policyTargetLeaf)
+    .filter(Boolean);
+}
+
+function splitPolicyTargetParts(target) {
+  if (typeof target !== 'string') {
+    return [];
+  }
+  return target
+    .split(/[|,]/)
+    .map((part) => part.trim())
+    .filter(Boolean);
+}
+
+function policyTargetLeaf(target) {
+  const parts = target.split('.').map((part) => part.trim()).filter(Boolean);
+  if (!parts.length) {
+    return '';
+  }
+  return parts[parts.length - 1]
+    .replace(/\[[^\]]*\]/g, '')
+    .replace(/[^A-Za-z0-9_]+/g, '')
+    .trim()
+    .toLowerCase();
+}
+
+function isProtectivePolicyStatement(statement) {
+  const action = statement?.apply?.action;
+  return (
+    action === 'DROP' ||
+    action === 'TOKENIZE' ||
+    (action === 'SUMMARIZE' && typeof statement?.apply?.rawTextMode === 'string')
+  );
+}
+
+function isExactPolicyStatement(statement) {
+  return (
+    statement?.apply?.action === 'KEEP_EXACT' &&
+    !statement?.apply?.rawTextMode &&
+    !statement?.apply?.descendantRawTextMode &&
+    !statement?.apply?.textPolicy
+  );
+}
+
+function isSafeOperationalPolicyLeaf(leaf) {
+  return (
+    /^(?:id|.*id|orderid|invoiceid|invoicenumber|shipmentid|taskid|tasktitle|paymentid|paymentreference|reference|sku|code|status|success|scenario|source|service|channel|direction|topic|partition|offset|priority|amount|currency|method|messagekey|cachekey|keyprefix|rediskey|duedate|createdat|updatedat|eventid|eventtype|retrycount|count|total|queue|flag)$/i.test(leaf) &&
+    !/(email|phone|name|address|customer|user|account|person|profile|contact|owner|operator|reviewer|requester|approver|assignee|analyst|agent|payer|payee|token|secret|password|cookie|session|apikey|connection|card|cvv|pan)/i.test(leaf)
+  );
+}
+
+function isStructuralPolicyLeaf(leaf) {
+  return /^(?:args|arg|returnvalue|data|payload|body|doc|docs|result|resultmeta|messages|message|value|headers|query|before|after|error)$/i.test(leaf);
+}
+
+function buildPolicyBlockerSummaries(statements, config, appId, environment, options = {}) {
+  return statements
+    .filter(isReviewBlockerStatement)
+    .map((statement) => {
+      const descriptor = describePolicyStatement(statement);
+      const review = statement?.meta?.review ?? {};
+      const query = descriptor.codeAnchor || descriptor.label || statement?.when?.selector || '';
+      const ui = buildPrivacyStudioUi(config, appId, environment, query, false);
+      const blocker = {
+        label: descriptor.label,
+        codeAnchor: descriptor.codeAnchor,
+        kind: descriptor.kind,
+        reviewStatus: review.status,
+        recommendation: review.recommendation,
+        choices: Array.isArray(review.choices) ? prioritizeReviewChoices(review.choices) : [],
+        currentPolicy: {
+          action: statement?.apply?.action,
+          rawTextMode: statement?.apply?.rawTextMode,
+          descendantRawTextMode: statement?.apply?.descendantRawTextMode,
+        },
+        targetSummary: descriptor.targetSummary,
+        reason: statement?.meta?.reasoning || review.reasoning || null,
+        reviewReason: review.reasoning || null,
+        suggestedNextStep: suggestedPolicyBlockerNextStep(statement),
+        ui,
+      };
+      if (options.includeTechnical === true) {
+        blocker.technical = {
+          statementSid: statement?.sid,
+          selector: statement?.when?.selector,
+          target: statement?.when?.target,
+        };
+      }
+      return blocker;
+    });
+}
+
+function prioritizeReviewChoices(choices) {
+  const priority = ['REGEX_ASSISTED', 'KEEP_RAW', 'SAFE_DROP', 'SAFE_PARTIAL_MASK'];
+  const unique = Array.from(new Set(choices.filter((choice) => typeof choice === 'string' && choice.trim())));
+  return unique.sort((left, right) => {
+    const leftIndex = priority.indexOf(left);
+    const rightIndex = priority.indexOf(right);
+    return (leftIndex === -1 ? priority.length : leftIndex) - (rightIndex === -1 ? priority.length : rightIndex);
+  });
+}
+
+function suggestedPolicyBlockerNextStep(statement) {
+  const review = statement?.meta?.review ?? {};
+  const action = statement?.apply?.action;
+  const rawTextMode = statement?.apply?.rawTextMode;
+  if (review.recommendation === 'REGEX_ASSISTED') {
+    if (rawTextMode) {
+      return 'Review the expected raw text. Use REGEX_ASSISTED with approved detectors for sensitive substrings, KEEP_EXACT only if the text is non-sensitive, and SAFE_PARTIAL_MASK only as a last-resort unknown-shape fallback.';
+    }
+    return 'Review the expected structured container. Keep the container exact when child field policies cover known leaves, and add regex-assisted descendant detectors only for sensitive unknown strings.';
+  }
+  if (action === 'SUMMARIZE') {
+    return 'Decide whether this raw/freeform value should be exact, dropped, or regex-assisted based on expected contents.';
+  }
+  return 'Resolve this review decision before approval.';
+}
+
+function buildPolicyInspectionAnswerGuide({ query, blockerQuery, policyBlockers, contradictions, ui }) {
+  const blockerLines = policyBlockers.map((blocker) => {
+    const mode = blocker.currentPolicy.rawTextMode || blocker.currentPolicy.descendantRawTextMode || blocker.currentPolicy.action || 'UNKNOWN';
+    return `${blocker.label}: current ${blocker.currentPolicy.action}${mode && mode !== blocker.currentPolicy.action ? ` / ${mode}` : ''}; recommendation ${blocker.recommendation || 'review'}; UI ${blocker.ui.url}`;
+  });
+  return {
+    lead: blockerQuery
+      ? `Answer with the ${policyBlockers.length} user-facing policy blocker(s), using label/codeAnchor names instead of field-* statement ids.`
+      : `Answer with user-facing code anchors and policy names for ${query || 'the selected policy'}.`,
+    presentationRules: [
+      'Do not lead with field-* or function-* statement ids; those are technical update handles only.',
+      'Use codeAnchor for function policies, such as fn:Service.method, and use the selector/runtime surface for field policies.',
+      'Include the Privacy Studio URL for the overall query and per-blocker URLs when blockers are present.',
+      'Mention SAFE_PARTIAL_MASK only as an existing policy mode or last-resort option, not as the default recommendation.',
+    ],
+    blockerLines,
+    contradictionLines: contradictions.map((contradiction) => contradiction.message),
+    privacyStudioUrl: ui?.url ?? null,
+  };
+}
+
+function describePolicyStatement(statement) {
+  const scope = statement?.when?.scope || 'UNKNOWN';
+  const selector = statement?.when?.selector || '';
+  const target = statement?.when?.target || '';
+  const targetSummary = summarizePolicyTargets(target);
+  if (scope === 'FUNCTION' || selector.startsWith('fn:')) {
+    const targetLabel = targetSummary.primaryPath ? ` ${humanizeFunctionTarget(targetSummary.primaryPath)}` : '';
+    return {
+      label: `${selector || 'function policy'}${targetLabel}`,
+      codeAnchor: selector || null,
+      kind: 'function',
+      targetSummary,
+    };
+  }
+
+  const selectorLabel = selector || targetSummary.primaryLeaf || 'policy value';
+  return {
+    label: `${selectorLabel}${isRawTextReviewStatement(statement) ? ' raw text' : ''}`,
+    codeAnchor: selector || targetSummary.primaryPath || null,
+    kind: inferPolicyStatementKind(statement, targetSummary),
+    targetSummary,
+  };
+}
+
+function isRawTextReviewStatement(statement) {
+  return (
+    statement?.meta?.review?.kind === 'UNSTRUCTURED_DATA' ||
+    statement?.apply?.rawTextMode ||
+    statement?.apply?.descendantRawTextMode
+  );
+}
+
+function inferPolicyStatementKind(statement, targetSummary) {
+  if (statement?.when?.scope === 'PATTERN') return 'pattern';
+  if (targetSummary.surfaces.some((surface) => /Kafka|event/.test(surface))) return 'event_payload';
+  if (targetSummary.surfaces.some((surface) => /HTTP request/.test(surface))) return 'request_field';
+  if (targetSummary.surfaces.some((surface) => /HTTP response/.test(surface))) return 'response_field';
+  if (targetSummary.surfaces.some((surface) => /Function/.test(surface))) return 'function_copy';
+  if (targetSummary.surfaces.some((surface) => /DB/.test(surface))) return 'db_copy';
+  return 'field';
+}
+
+function summarizePolicyTargets(target) {
+  const parts = splitPolicyTargetParts(target);
+  const surfaces = [];
+  const addSurface = (label) => {
+    if (!surfaces.includes(label)) surfaces.push(label);
+  };
+  for (const part of parts) {
+    if (/^request\.headers\./.test(part)) addSurface('HTTP request headers');
+    else if (/^request\.body\./.test(part) || part === 'request.body') addSurface('HTTP request body');
+    else if (/^request\.query\./.test(part) || part === 'request.query') addSurface('HTTP request query');
+    else if (/^response\.body/.test(part)) addSurface('HTTP response body');
+    else if (/^trace\.args\[0\]\.messages\[\]/.test(part) || /^trace\.args\[0\]\.messages\[0\]\.value/.test(part)) addSurface('Kafka/event payload copy');
+    else if (/^trace\.args/.test(part)) addSurface('Function arguments');
+    else if (/^trace\.returnValue/.test(part)) addSurface('Function return value');
+    else if (/^trace\.error/.test(part)) addSurface('Function error');
+    else if (/^db\./.test(part)) addSurface('DB/query/document copy');
+    else if (/\.payload\./.test(part) || /\.payload$/.test(part)) addSurface('Nested payload copy');
+    else addSurface('Runtime capture path');
+  }
+  return {
+    pathCount: parts.length,
+    surfaces,
+    primaryPath: parts[0] || null,
+    primaryLeaf: parts[0] ? policyTargetLeaf(parts[0]) : null,
+    examples: parts.slice(0, 6),
+  };
+}
+
+function humanizeFunctionTarget(target) {
+  if (/^trace\.args/.test(target)) return 'arguments';
+  if (/^trace\.returnValue/.test(target)) return 'return value';
+  if (/^trace\.error/.test(target)) return 'error';
+  return target;
+}
+
+function formatPolicyMatch(statement, score, options = {}) {
+  return {
+    score,
+    ...formatPolicyStatementSummary(statement, options),
+    review: statement?.meta?.review
+      ? {
+          status: statement.meta.review.status,
+          decision: statement.meta.review.decision,
+          rawTextHintNames: statement.meta.review.rawTextHintNames,
+        }
+      : undefined,
+    reasoning: statement?.meta?.reasoning,
+  };
+}
+
+function formatPolicyStatementSummary(statement, options = {}) {
+  const descriptor = describePolicyStatement(statement);
+  const summary = {
+    label: descriptor.label,
+    codeAnchor: descriptor.codeAnchor,
+    kind: descriptor.kind,
+    scope: statement?.when?.scope,
+    selector: statement?.when?.selector,
+    targetSummary: descriptor.targetSummary,
+    pattern: statement?.when?.pattern,
+    action: statement?.apply?.action,
+    rawTextMode: statement?.apply?.rawTextMode,
+    descendantRawTextMode: statement?.apply?.descendantRawTextMode,
+    policy: {
+      action: statement?.apply?.action,
+      rawTextMode: statement?.apply?.rawTextMode,
+      descendantRawTextMode: statement?.apply?.descendantRawTextMode,
+    },
+  };
+  if (options.includeTechnical === true) {
+    summary.technical = {
+      statementSid: statement?.sid,
+      target: statement?.when?.target,
+    };
+  }
+  return summary;
+}
+
+function statementSortKey(statement) {
+  return `${statement?.when?.scope ?? ''}|${statement?.when?.selector ?? ''}|${statement?.sid ?? ''}`;
+}
+
+function summarizePolicyInspection(matches, contradictions, query, blockerQuery = false) {
+  if (blockerQuery) {
+    return `Found ${matches.length} unresolved privacy policy review blocker(s) for ${query || 'the selected policy'}.`;
+  }
+  if (contradictions.length > 0) {
+    return `Found ${matches.length} matching statement(s) and ${contradictions.length} same-leaf contradiction(s) for ${query || 'the selected policy'}.`;
+  }
+  if (matches.length > 0) {
+    return `Found ${matches.length} matching privacy policy statement(s) for ${query || 'the selected policy'}.`;
+  }
+  return `No matching privacy policy statements found for ${query || 'the selected query'}.`;
+}
+
+function summarizeRawTextHints(policy, query) {
+  const hints = Array.isArray(policy?.rawTextHints) ? policy.rawTextHints : [];
+  const normalizedQuery = typeof query === 'string' ? query.toLowerCase() : '';
+  return hints
+    .filter((hint) => {
+      if (!normalizedQuery) {
+        return true;
+      }
+      return [
+        hint?.name,
+        hint?.tokenLabel,
+        hint?.regex,
+        hint?.action,
+      ].filter(Boolean).join(' ').toLowerCase().includes(normalizedQuery);
+    })
+    .slice(0, 12)
+    .map((hint) => ({
+      name: hint?.name,
+      scope: hint?.scope,
+      action: hint?.action,
+      regex: hint?.regex,
+      tokenLabel: hint?.tokenLabel,
+    }));
+}
+
+function buildPrivacyStudioUi(config, appId, environment, query, openRequested) {
+  const baseUrl = config.webBaseUrl || deriveWebBaseUrl(config.apiBaseUrl);
+  if (!baseUrl) {
+    return {
+      url: null,
+      path: '/admin/privacy',
+      openRequested,
+      opened: false,
+    };
+  }
+
+  const url = new URL('/admin/privacy', baseUrl);
+  url.searchParams.set('service', appId);
+  if (environment) {
+    url.searchParams.set('env', environment);
+  }
+  if (query) {
+    url.searchParams.set('q', query);
+  }
+  return {
+    url: url.toString(),
+    path: `${url.pathname}${url.search}`,
+    openRequested,
+    opened: false,
+  };
+}
+
+async function privacyAuditSession(input, config, client) {
+  const tenantId = requireNonEmptyString(input.tenantId, 'tenantId');
+  const sessionId = requireNonEmptyString(input.sessionId, 'sessionId');
+  const maxRequests = clampPositiveInteger(input.maxRequests, 30, 1, 100);
+  const maxDbChanges = clampPositiveInteger(input.maxDbChanges, 200, 1, 500);
+  const includeTraces = input.includeTraces === true;
+  const sources = [];
+  const errors = [];
+
+  const requests = await callBackendTool(client, 'list_requests', {
+    tenantId,
+    sessionId,
+    limit: maxRequests,
+  }, errors);
+  const requestItems = extractItems(requests).slice(0, maxRequests);
+
+  for (const request of requestItems) {
+    const rid = typeof request?.rid === 'string' ? request.rid : undefined;
+    if (!rid) continue;
+    const detail = await callBackendTool(client, 'get_request', {
+      tenantId,
+      sessionId,
+      requestRid: rid,
+      includeBody: true,
+      includeResponseBody: true,
+    }, errors);
+    sources.push({
+      kind: 'request',
+      id: rid,
+      label: `${request.method ?? 'REQUEST'} ${request.url ?? rid}`,
+      value: detail,
+    });
+  }
+
+  const dbChanges = await callBackendTool(client, 'get_db_changes', {
+    tenantId,
+    sessionId,
+    limit: maxDbChanges,
+    includeQueryDetails: true,
+  }, errors);
+  sources.push({
+    kind: 'db_changes',
+    id: sessionId,
+    label: `DB changes for ${sessionId}`,
+    value: dbChanges,
+  });
+
+  if (includeTraces) {
+    for (const request of requestItems) {
+      const rid = typeof request?.rid === 'string' ? request.rid : undefined;
+      if (!rid) continue;
+      const trace = await callBackendTool(client, 'get_trace', {
+        tenantId,
+        sessionId,
+        requestRid: rid,
+        includeEvents: true,
+      }, errors);
+      sources.push({
+        kind: 'trace',
+        id: rid,
+        label: `trace ${rid}`,
+        value: trace,
+      });
+    }
+  }
+
+  const findings = [];
+  for (const source of sources) {
+    scanPrivacyValue(source.value, [], source, findings);
+  }
+
+  const leaks = findings.filter((finding) => finding.severity === 'leak');
+  const warnings = findings.filter((finding) => finding.severity === 'warning');
+  return {
+    status: leaks.length ? 'failed' : warnings.length ? 'warning' : 'ok',
+    data: {
+      sessionId,
+      scanned: {
+        requests: requestItems.length,
+        dbChanges: extractItems(dbChanges).length,
+        traces: includeTraces ? requestItems.length : 0,
+      },
+      leaks,
+      warnings,
+      errors,
+    },
+  };
+}
+
+async function callBackendTool(client, name, args, errors) {
+  try {
+    return await client.executeTool(name, args);
+  } catch (error) {
+    errors.push({
+      tool: name,
+      message: error instanceof Error ? error.message : String(error),
+    });
+    return null;
+  }
+}
+
+function extractItems(payload) {
+  if (Array.isArray(payload)) return payload;
+  if (Array.isArray(payload?.items)) return payload.items;
+  if (Array.isArray(payload?.data?.items)) return payload.data.items;
+  if (Array.isArray(payload?.data?.requests)) return payload.data.requests;
+  return [];
+}
+
+function scanPrivacyValue(value, pathParts, source, findings) {
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => scanPrivacyValue(item, pathParts.concat(String(index)), source, findings));
+    return;
+  }
+
+  if (!value || typeof value !== 'object') {
+    if (typeof value === 'string') {
+      scanPrivacyString(value, pathParts, source, findings);
+    }
+    return;
+  }
+
+  for (const [key, child] of Object.entries(value)) {
+    scanPrivacyValue(child, pathParts.concat(key), source, findings);
+  }
+}
+
+function scanPrivacyString(value, pathParts, source, findings) {
+  const pathLabel = pathParts.join('.');
+  const normalizedPath = pathLabel.toLowerCase().replace(/[^a-z0-9.]+/g, '');
+  const add = (severity, kind, match, message) => {
+    findings.push({
+      severity,
+      kind,
+      source: {
+        kind: source.kind,
+        id: source.id,
+        label: source.label,
+      },
+      path: pathLabel || '$',
+      sample: sampleText(match),
+      message,
+    });
+  };
+
+  collectRegexMatchEntries(value, /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi)
+    .filter((entry) => !/^email_tok_[a-f0-9]{8,}$/i.test(entry.match))
+    .filter((entry) => !isEmailInsideUrlCredential(value, entry.start))
+    .forEach((entry) => add('leak', 'raw_email', entry.match, 'Raw email was captured instead of a deterministic email token.'));
+
+  for (const pattern of RAW_SECRET_PATTERNS) {
+    collectRegexMatches(value, pattern.pattern).forEach((match) =>
+      add('leak', pattern.kind, match, pattern.message),
+    );
+  }
+
+  if (/(^|\.)(cvv|cvc|securitycode)$/.test(normalizedPath) && /^\d{3,4}$/.test(value.trim())) {
+    add('leak', 'card_verification_code', value, 'Raw card verification code was captured.');
+  }
+
+  collectRegexMatches(value, /\b(?:\d[ -]*?){13,19}\b/g)
+    .filter((match) => !shouldIgnoreNumericLeakCandidate(match))
+    .forEach((match) => add('leak', 'card_number', match, 'Raw card number-like value was captured.'));
+
+  if (/\[object Object\]/.test(value)) {
+    add('warning', 'collapsed_object', value, 'A rich object was coerced into [object Object].');
+  }
+
+  if (/\[partially masked object\]/.test(value)) {
+    add('warning', 'over_masked_object', value, 'A structured object was replaced by a generic fallback marker.');
+  }
+
+  if (isAuthPath(normalizedPath) && value !== '[dropped]') {
+    add('warning', 'auth_field_not_dropped', value, 'Auth-bearing field was not fully dropped.');
+  }
+
+  if (isSafeOperationalPath(normalizedPath) && /^[A-Za-z0-9]{2,4}\.\.\.[A-Za-z0-9]{0,4}$/.test(value.trim())) {
+    add('warning', 'over_masked_operational_value', value, 'Safe operational field appears fallback-masked.');
+  }
+}
+
+const RAW_SECRET_PATTERNS = [
+  {
+    kind: 'jwt',
+    pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+    message: 'Raw JWT was captured.',
+  },
+  {
+    kind: 'private_key',
+    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]+?-----END [A-Z ]*PRIVATE KEY-----/g,
+    message: 'Raw private key material was captured.',
+  },
+  {
+    kind: 'connection_string',
+    pattern: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^\s"']+/gi,
+    message: 'Raw connection string was captured.',
+  },
+  {
+    kind: 'bearer_token',
+    pattern: /\bBearer\s+(?!\[(?:dropped|secret-token|auth-token)\])[A-Za-z0-9._\-+/=]{8,}\b/gi,
+    message: 'Raw bearer token was captured.',
+  },
+];
+
+function collectRegexMatches(value, pattern) {
+  return collectRegexMatchEntries(value, pattern).map((entry) => entry.match);
+}
+
+function collectRegexMatchEntries(value, pattern) {
+  const matches = [];
+  const globalPattern = new RegExp(pattern.source, pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`);
+  let match;
+  while ((match = globalPattern.exec(value))) {
+    if (match[0]) {
+      matches.push({
+        match: match[0],
+        start: match.index,
+        end: match.index + match[0].length,
+      });
+    }
+  }
+  return matches;
+}
+
+function isEmailInsideUrlCredential(value, start) {
+  const prefix = value.slice(Math.max(0, start - 80), start);
+  const protocolIndex = prefix.lastIndexOf('://');
+  if (protocolIndex < 0) {
+    return false;
+  }
+  const afterProtocol = prefix.slice(protocolIndex + 3);
+  return !/\s/.test(afterProtocol) && afterProtocol.includes(':');
+}
+
+function shouldIgnoreNumericLeakCandidate(value) {
+  const digits = value.replace(/\D/g, '');
+  if (digits.length < 13 || digits.length > 19) {
+    return true;
+  }
+  if (/^\d{10,14}$/.test(digits)) {
+    return true;
+  }
+  return false;
+}
+
+function isAuthPath(normalizedPath) {
+  return /(^|\.)(authorization|headerauthorization|auth|token|secret|password|cookie|sessioncookie|apikey|xapikey|xapikey|xwebhooksecret|webhooksecret)$/.test(normalizedPath);
+}
+
+function isSafeOperationalPath(normalizedPath) {
+  return /(^|\.)(status|taskstatus|rawgatewaystatus|priority|scenario|success|classification|currency|method|queue|safequeue|region|saferegion|stage|workflowstage|featureflag|safefeatureflag|reasoncode|shard|reference|paymentreference|messagekey|eventtype)$/.test(normalizedPath);
+}
+
+function sampleText(value) {
+  const text = String(value);
+  return text.length > 180 ? `${text.slice(0, 177)}...` : text;
+}
+
+function requireNonEmptyString(value, label) {
+  if (typeof value !== 'string' || !value.trim()) {
+    throw rpcError(-32602, `${label} is required`);
+  }
+  return value.trim();
+}
+
+function optionalNonEmptyString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+
+function clampPositiveInteger(value, fallback, min, max) {
+  const parsed = Number.parseInt(String(value ?? ''), 10);
+  if (!Number.isFinite(parsed)) {
+    return fallback;
+  }
+  return Math.max(min, Math.min(max, parsed));
+}
+
+function normalizeToolArguments(value) {
+  if (value == null) {
+    return {};
+  }
+  if (typeof value !== 'object' || Array.isArray(value)) {
+    throw rpcError(-32602, 'Tool arguments must be an object');
+  }
+  return value;
+}
+
+function prepareToolInput(input, config) {
+  const normalized = { ...input };
+  if (!normalized.tenantId) {
+    if (!config.defaultTenantId) {
+      throw rpcError(
+        -32602,
+        'tenantId is required unless REPRO_DEFAULT_TENANT_ID is configured',
+      );
+    }
+    normalized.tenantId = config.defaultTenantId;
+  }
+  return normalized;
+}
+
+function augmentPaths(value, pathMappings) {
+  if (Array.isArray(value)) {
+    return value.map((item) => augmentPaths(item, pathMappings));
+  }
+
+  if (!value || typeof value !== 'object') {
+    return value;
+  }
+
+  const result = {};
+  for (const [key, nestedValue] of Object.entries(value)) {
+    result[key] = augmentPaths(nestedValue, pathMappings);
+  }
+
+  const deployedPath =
+    typeof result.deployedPath === 'string'
+      ? result.deployedPath
+      : typeof result.file === 'string'
+        ? result.file
+        : typeof result.filePath === 'string'
+          ? result.filePath
+        : null;
+
+  if (deployedPath && result.deployedPath == null) {
+    result.deployedPath = deployedPath;
+  }
+
+  if (!result.repoRelativePath && deployedPath) {
+    const derivedRepoRelativePath = deriveRepoRelativePath(deployedPath, pathMappings);
+    if (derivedRepoRelativePath) {
+      result.repoRelativePath = derivedRepoRelativePath;
+    }
+  }
+
+  const localPath = resolveLocalPath(
+    deployedPath,
+    typeof result.repoRelativePath === 'string' ? result.repoRelativePath : null,
+    pathMappings,
+  );
+  if (localPath && result.localPath == null) {
+    result.localPath = localPath;
+  }
+
+  return result;
+}
+
+function deriveRepoRelativePath(deployedPath, pathMappings) {
+  if (!isAbsolutePath(deployedPath)) {
+    return deployedPath;
+  }
+
+  const mapping = findMatchingPathMapping(deployedPath, pathMappings);
+  if (!mapping) {
+    return null;
+  }
+
+  const suffix = trimLeadingSeparators(deployedPath.slice(mapping.remotePrefix.length));
+  return suffix || path.basename(deployedPath);
+}
+
+function resolveLocalPath(deployedPath, repoRelativePath, pathMappings) {
+  if (typeof deployedPath === 'string' && isAbsolutePath(deployedPath)) {
+    const mapping = findMatchingPathMapping(deployedPath, pathMappings);
+    if (mapping) {
+      const suffix = trimLeadingSeparators(deployedPath.slice(mapping.remotePrefix.length));
+      return suffix ? path.join(mapping.localPrefix, suffix) : mapping.localPrefix;
+    }
+  }
+
+  if (typeof repoRelativePath === 'string' && repoRelativePath && pathMappings.length > 0) {
+    return path.join(pathMappings[0].localPrefix, repoRelativePath);
+  }
+
+  if (typeof deployedPath === 'string' && deployedPath && !isAbsolutePath(deployedPath) && pathMappings.length > 0) {
+    return path.join(pathMappings[0].localPrefix, deployedPath);
+  }
+
+  return null;
+}
+
+function findMatchingPathMapping(targetPath, pathMappings) {
+  let bestMatch = null;
+  for (const mapping of pathMappings) {
+    if (
+      targetPath === mapping.remotePrefix ||
+      targetPath.startsWith(`${mapping.remotePrefix}/`) ||
+      targetPath.startsWith(`${mapping.remotePrefix}${path.sep}`)
+    ) {
+      if (!bestMatch || mapping.remotePrefix.length > bestMatch.remotePrefix.length) {
+        bestMatch = mapping;
+      }
+    }
+  }
+  return bestMatch;
+}
+
+function trimLeadingSeparators(value) {
+  return value.replace(/^[\\/]+/, '');
+}
+
+function isAbsolutePath(value) {
+  return path.isAbsolute(value);
+}
+
+function rpcError(code, message, data) {
+  const error = new Error(message);
+  error.rpcCode = code;
+  error.rpcData = data;
+  return error;
+}
+
+function startStdioServer(server) {
+  let buffer = Buffer.alloc(0);
+  let draining = false;
+  let transportMode = null;
+
+  process.stdin.on('end', () => {
+    debugLog('stdin end');
+  });
+
+  process.stdin.on('close', () => {
+    debugLog('stdin close');
+  });
+
+  process.stdin.on('data', (chunk) => {
+    debugLog(
+      `stdin data bytes=${chunk.length} text=${summarizeChunkForLog(chunk)}`,
+    );
+    buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
+    if (!draining) {
+      draining = true;
+      drain().finally(() => {
+        draining = false;
+      });
+    }
+  });
+
+  process.stdin.on('error', (error) => {
+    logError('stdin error', error);
+  });
+
+  async function drain() {
+    while (true) {
+      const parsed = parseFrame(buffer);
+      if (!parsed) {
+        return;
+      }
+
+      buffer = parsed.rest;
+      if (!transportMode) {
+        transportMode = parsed.transport;
+        debugLog(`transport mode=${transportMode}`);
+      }
+      let message;
+      try {
+        message = JSON.parse(parsed.body);
+      } catch (error) {
+        logError('failed to parse JSON-RPC payload', error);
+        continue;
+      }
+
+      try {
+        const response = await server.handleMessage(message);
+        if (response) {
+          writeMessage(response, transportMode || 'framed');
+        }
+      } catch (error) {
+        logError('failed to handle JSON-RPC message', error);
+        if (message && Object.prototype.hasOwnProperty.call(message, 'id')) {
+          writeMessage(formatRpcErrorResponse(message.id, error), transportMode || 'framed');
+        }
+      }
+    }
+  }
+}
+
+function startHttpServer(mcpServer, config) {
+  const httpServer = http.createServer(createHttpRequestHandler(mcpServer, config));
+  httpServer.listen(config.httpPort, config.httpHost, () => {
+    process.stderr.write(
+      `[${SERVER_NAME}] HTTP MCP listening on http://${config.httpHost}:${config.httpPort}${config.httpPath}\n`,
+    );
+  });
+  return httpServer;
+}
+
+function createHttpRequestHandler(mcpServer, config) {
+  return async (request, response) => {
+    applyCorsHeaders(response, config);
+
+    if (request.method === 'OPTIONS') {
+      response.writeHead(204);
+      response.end();
+      return;
+    }
+
+    const requestUrl = new URL(request.url || '/', `http://${request.headers.host || 'localhost'}`);
+    if (request.method === 'GET' && isHealthPath(requestUrl.pathname)) {
+      writeJsonResponse(response, 200, {
+        status: 'ok',
+        service: SERVER_NAME,
+        transport: 'http',
+      });
+      return;
+    }
+
+    if (requestUrl.pathname !== config.httpPath) {
+      writeJsonResponse(response, 404, {
+        error: 'Not found',
+      });
+      return;
+    }
+
+    if (request.method === 'GET') {
+      startHttpEventStream(request, response, config);
+      return;
+    }
+
+    if (request.method !== 'POST') {
+      response.setHeader('Allow', 'GET, POST, OPTIONS');
+      writeJsonResponse(response, 405, {
+        error: 'Method not allowed',
+      });
+      return;
+    }
+
+    let payload;
+    try {
+      const body = await readHttpRequestBody(request, config.httpMaxBodyBytes);
+      payload = body ? JSON.parse(body) : null;
+    } catch (error) {
+      const rpcResponse = formatRpcErrorResponse(null, rpcError(-32700, error instanceof Error ? error.message : 'Parse error'));
+      writeJsonResponse(response, 400, rpcResponse);
+      return;
+    }
+
+    try {
+      const rpcResponse = await handleHttpRpcPayload(mcpServer, payload);
+      if (rpcResponse == null) {
+        response.writeHead(202);
+        response.end();
+        return;
+      }
+      writeJsonResponse(response, 200, rpcResponse, {
+        'mcp-protocol-version': SUPPORTED_PROTOCOL_VERSION,
+      });
+    } catch (error) {
+      const id = payload && typeof payload === 'object' && !Array.isArray(payload) && Object.prototype.hasOwnProperty.call(payload, 'id')
+        ? payload.id
+        : null;
+      const statusCode =
+        error && typeof error === 'object' && typeof error.httpStatusCode === 'number'
+          ? error.httpStatusCode
+          : 500;
+      writeJsonResponse(response, statusCode, formatRpcErrorResponse(id, error), {
+        'mcp-protocol-version': SUPPORTED_PROTOCOL_VERSION,
+      });
+    }
+  };
+}
+
+function applyCorsHeaders(response, config) {
+  response.setHeader('Access-Control-Allow-Origin', config.corsOrigin || '*');
+  response.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+  response.setHeader('Access-Control-Allow-Headers', 'content-type, accept, mcp-protocol-version, mcp-session-id, authorization');
+  response.setHeader('Access-Control-Expose-Headers', 'mcp-protocol-version, mcp-session-id');
+}
+
+function isHealthPath(pathname) {
+  return pathname === '/health' || pathname === '/healthz' || pathname === '/';
+}
+
+function startHttpEventStream(request, response, config) {
+  response.writeHead(200, {
+    'content-type': 'text/event-stream',
+    'cache-control': 'no-cache, no-transform',
+    connection: 'keep-alive',
+    'mcp-protocol-version': SUPPORTED_PROTOCOL_VERSION,
+  });
+  response.write(`: ${SERVER_NAME} ready\n\n`);
+  const interval = setInterval(() => {
+    response.write(': ping\n\n');
+  }, positiveIntegerOrFallback(config.httpKeepAliveMs, 30000));
+  request.on('close', () => {
+    clearInterval(interval);
+  });
+}
+
+async function handleHttpRpcPayload(mcpServer, payload) {
+  if (Array.isArray(payload)) {
+    const responses = [];
+    for (const message of payload) {
+      const response = await mcpServer.handleMessage(message);
+      if (response) {
+        responses.push(response);
+      }
+    }
+    return responses.length ? responses : null;
+  }
+  return mcpServer.handleMessage(payload);
+}
+
+function readHttpRequestBody(request, maxBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let totalBytes = 0;
+    request.on('data', (chunk) => {
+      totalBytes += chunk.length;
+      if (totalBytes > maxBytes) {
+        reject(new Error(`HTTP request body exceeds ${maxBytes} bytes`));
+        request.destroy();
+        return;
+      }
+      chunks.push(Buffer.from(chunk));
+    });
+    request.on('end', () => {
+      resolve(Buffer.concat(chunks).toString('utf8'));
+    });
+    request.on('error', reject);
+  });
+}
+
+function writeJsonResponse(response, statusCode, payload, headers = {}) {
+  const body = JSON.stringify(payload);
+  response.writeHead(statusCode, {
+    'content-type': 'application/json',
+    'content-length': Buffer.byteLength(body),
+    ...headers,
+  });
+  response.end(body);
+}
+
+function parseFrame(buffer) {
+  const headerBoundary = findHeaderBoundary(buffer);
+  if (headerBoundary) {
+    const headerText = buffer.subarray(0, headerBoundary.index).toString('utf8');
+    const headers = parseHeaders(headerText);
+    const contentLengthHeader = headers['content-length'];
+    if (!contentLengthHeader) {
+      throw new Error('Missing Content-Length header');
+    }
+
+    const contentLength = Number.parseInt(contentLengthHeader, 10);
+    if (!Number.isFinite(contentLength) || contentLength < 0) {
+      throw new Error(`Invalid Content-Length header: ${contentLengthHeader}`);
+    }
+
+    const bodyStart = headerBoundary.bodyStart;
+    const bodyEnd = bodyStart + contentLength;
+    if (buffer.length < bodyEnd) {
+      return null;
+    }
+
+    return {
+      body: buffer.subarray(bodyStart, bodyEnd).toString('utf8'),
+      rest: buffer.subarray(bodyEnd),
+      transport: 'framed',
+    };
+  }
+
+  const lineMessage = parseLineDelimitedMessage(buffer);
+  if (lineMessage) {
+    return lineMessage;
+  }
+
+  return null;
+}
+
+function findHeaderBoundary(buffer) {
+  const crlfIndex = buffer.indexOf('\r\n\r\n');
+  if (crlfIndex !== -1) {
+    return {
+      index: crlfIndex,
+      bodyStart: crlfIndex + 4,
+    };
+  }
+
+  const lfIndex = buffer.indexOf('\n\n');
+  if (lfIndex !== -1) {
+    return {
+      index: lfIndex,
+      bodyStart: lfIndex + 2,
+    };
+  }
+
+  return null;
+}
+
+function parseHeaders(headerText) {
+  const headers = {};
+  for (const line of headerText.split(/\r?\n/)) {
+    if (!line) {
+      continue;
+    }
+    const separatorIndex = line.indexOf(':');
+    if (separatorIndex === -1) {
+      continue;
+    }
+    const key = line.slice(0, separatorIndex).trim().toLowerCase();
+    const value = line.slice(separatorIndex + 1).trim();
+    headers[key] = value;
+  }
+  return headers;
+}
+
+function parseLineDelimitedMessage(buffer) {
+  let start = 0;
+  while (start < buffer.length && isWhitespaceByte(buffer[start])) {
+    start += 1;
+  }
+
+  if (start >= buffer.length) {
+    return null;
+  }
+
+  const firstByte = buffer[start];
+  if (firstByte !== 0x7b && firstByte !== 0x5b) {
+    return null;
+  }
+
+  const newlineIndex = buffer.indexOf('\n', start);
+  if (newlineIndex === -1) {
+    return null;
+  }
+
+  let bodyEnd = newlineIndex;
+  if (bodyEnd > start && buffer[bodyEnd - 1] === 0x0d) {
+    bodyEnd -= 1;
+  }
+
+  return {
+    body: buffer.subarray(start, bodyEnd).toString('utf8'),
+    rest: buffer.subarray(newlineIndex + 1),
+    transport: 'line',
+  };
+}
+
+function isWhitespaceByte(byte) {
+  return byte === 0x20 || byte === 0x09 || byte === 0x0a || byte === 0x0d;
+}
+
+function writeMessage(message, transportMode = 'framed') {
+  const body = JSON.stringify(message);
+  debugLog(
+    `send transport=${transportMode} id=${Object.prototype.hasOwnProperty.call(message, 'id') ? String(message.id) : '-'} hasResult=${Object.prototype.hasOwnProperty.call(message, 'result')} hasError=${Object.prototype.hasOwnProperty.call(message, 'error')}`,
+  );
+  if (transportMode === 'line') {
+    process.stdout.write(`${body}\n`);
+    return;
+  }
+
+  const payload = `Content-Length: ${Buffer.byteLength(body, 'utf8')}\r\n\r\n${body}`;
+  process.stdout.write(payload);
+}
+
+function formatRpcErrorResponse(id, error) {
+  return {
+    jsonrpc: JSON_RPC_VERSION,
+    id,
+    error: {
+      code: typeof error?.rpcCode === 'number' ? error.rpcCode : -32603,
+      message: error instanceof Error ? error.message : 'Internal error',
+      data: error && typeof error === 'object' && 'rpcData' in error ? error.rpcData : undefined,
+    },
+  };
+}
+
+function logError(message, error) {
+  const suffix = error instanceof Error ? error.stack || error.message : String(error);
+  debugLog(`error ${message}: ${suffix}`);
+  process.stderr.write(`[${SERVER_NAME}] ${message}: ${suffix}\n`);
+}
+
+async function main() {
+  const config = loadConfig();
+  debugLog(`startup pid=${process.pid} cwd=${process.cwd()} baseUrl=${config.baseUrl} transport=${config.transport}`);
+  const server = createMcpServer(config);
+  if (config.autoAuth && !config.apiToken && config.apiBaseUrl && config.authMode === 'wait') {
+    server.primeAuth().catch((error) => {
+      debugLog(`background auth bootstrap failed: ${error instanceof Error ? error.message : String(error)}`);
+    });
+  }
+  if (config.transport === 'http') {
+    startHttpServer(server, config);
+    return;
+  }
+  process.stderr.write(`[${SERVER_NAME}] running on stdio\n`);
+  startStdioServer(server);
+}
+
+function debugLog(message) {
+  if (!DEBUG_LOG_PATH) {
+    return;
+  }
+
+  const line = `${new Date().toISOString()} ${message}\n`;
+  try {
+    fs.appendFileSync(DEBUG_LOG_PATH, line, 'utf8');
+  } catch {
+    // Swallow log write failures so stdio behavior is unaffected.
+  }
+}
+
+function summarizeForLog(value) {
+  if (value == null) {
+    return '-';
+  }
+
+  try {
+    const text = JSON.stringify(value);
+    return text.length > 500 ? `${text.slice(0, 500)}...` : text;
+  } catch {
+    return '[unserializable]';
+  }
+}
+
+function summarizeChunkForLog(chunk) {
+  const text = Buffer.from(chunk).toString('utf8');
+  return text.length > 500 ? `${JSON.stringify(text.slice(0, 500))}...` : JSON.stringify(text);
+}
+
+if (require.main === module) {
+  main().catch((error) => {
+    logError('fatal startup error', error);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  createMcpServer,
+  loadConfig,
+  normalizeBaseUrl,
+  normalizeOptionalBaseUrl,
+  parsePathMappings,
+  createReproAiClient,
+  createReproAuthClient,
+  createHttpRequestHandler,
+  startHttpServer,
+  normalizeToolCatalog,
+  prepareToolInput,
+  augmentPaths,
+  resolveLocalPath,
+  deriveRepoRelativePath,
+  handleRpcMessage,
+  parseFrame,
+  publicToolDefinition,
+  formatRpcErrorResponse,
+  readStoredAuth,
+  storeAuth,
+  clearPersistedAuth,
+  resolveAuthFilePath,
+};