@rockhopper-co/mcp-server 2.0.1 → 2.1.1

package/dist/tools/drive-search.js

@@ -0,0 +1,209 @@
+import { randomUUID } from 'node:crypto';
+import { inputRequired, inputResponse, } from '@modelcontextprotocol/server';
+import { CandidateRegistry, SearchBudget, classifyDriveSearchFailure, ADMIN_CONSENT_TEXT, isAdminConsentRequired, isNoDelegatedToken, toCandidate, } from '../drive-search.js';
+import { log } from '../logger.js';
+import { BUDGET_EXHAUSTED_TEXT, DECLINE_CHOICE, DRIVE_SEARCH_ANNOTATIONS, DRIVE_SEARCH_DESCRIPTION, DRIVE_SEARCH_INPUT_SCHEMA, confirmationForm, confirmationPrompt, confirmedAnswer, connectPrompt, declinedAnswer, toolResult, unknownCandidateAnswer, } from './drive-search.contract.js';
+import { CONFIRM_KEY, readRequestState, selectLane, } from './drive-search-lanes.js';
+/**
+ * ENG-2204 (SP08) — the half of ENG-1647 that ENG-2200 did not fix.
+ *
+ * ENG-2200 built the enroll tool the customer could not find. This finds the
+ * FILE: a workbook Rockhopper has never seen, in the user's own OneDrive or
+ * SharePoint, confirmed with them before anything is written.
+ *
+ * Three things here are load-bearing and none is obvious from the happy path:
+ *
+ * 1. **The search set IS the permission trim.** Every candidate came back from
+ *    a delegated Microsoft call made as this user. Nothing is added to it,
+ *    nothing is inferred into it, and no file outside it is ever offered.
+ * 2. **A confirmation resolves against SERVER memory, never against what the
+ *    client sent.** The confirmation carries a position and a nonce; the file
+ *    it names is looked up in the set this session actually returned. A model
+ *    that has read a hostile file name cannot conjure a `driveMsId` and have
+ *    the tool bless it.
+ * 3. **The budget is claimed BEFORE the network call.** A cap that discards an
+ *    answer already fetched has not capped anything — the enumeration already
+ *    happened, and Microsoft already answered it.
+ */
+export function registerDriveSearchTool(server, api, session) {
+    // Per-server, never per-module: two servers in one process (a test file, a
+    // gateway serving two sessions) must not share a ceiling, and a module-level
+    // counter is exactly the shape that silently does.
+    const budget = session?.budget ?? new SearchBudget();
+    const registry = session?.registry ?? new CandidateRegistry();
+    /**
+     * Resolve a (nonce, position) pair against what this session offered.
+     *
+     * Position, never identifier — the only thing a client can send is a number,
+     * and a number that does not index a set this session returned resolves to
+     * nothing. `0` and the elicitation form's "none of these" are the same
+     * answer: the user was asked and chose no file.
+     */
+    function resolvePick(nonce, choice) {
+        if (choice === DECLINE_CHOICE || choice === 0)
+            return declinedAnswer();
+        if (!nonce)
+            return unknownCandidateAnswer();
+        const position = typeof choice === 'number' ? choice : Number(choice);
+        const candidate = registry.resolve(nonce, position - 1);
+        return candidate ? confirmedAnswer(candidate) : unknownCandidateAnswer();
+    }
+    /**
+     * Put the question through the best lane this request can reach.
+     *
+     * Lane 2 is awaited INSIDE the call and lane 3 returns out of it; both end
+     * at the same three answers, and lane 1 hands the question to the model.
+     */
+    async function ask(ctx, candidates, nonce) {
+        const lane = selectLane(ctx, server.server?.getClientCapabilities?.());
+        const form = confirmationForm(candidates);
+        if (lane === 'input_required') {
+            return inputRequired({
+                inputRequests: { [CONFIRM_KEY]: inputRequired.elicit(form) },
+                requestState: nonce,
+            });
+        }
+        if (lane === 'elicitation' && ctx?.mcpReq?.elicitInput) {
+            try {
+                const answer = await ctx.mcpReq.elicitInput({ ...form, mode: 'form' });
+                if (answer?.action === 'accept') {
+                    const choice = answer.content
+                        ?.choice;
+                    return resolvePick(nonce, choice ?? DECLINE_CHOICE);
+                }
+                // Declined or cancelled. Both mean the user did not choose a file, and
+                // neither is an error: a person is allowed to say no.
+                return declinedAnswer();
+            }
+            catch {
+                // The client advertised elicitation and could not deliver it. Falling
+                // back to the universal lane keeps the question answerable instead of
+                // turning a capability mismatch into a dead end.
+            }
+        }
+        return toolResult({
+            outcome: 'candidates',
+            text: confirmationPrompt(candidates, nonce),
+            detail: { confirmToken: nonce, candidateCount: candidates.length },
+        });
+    }
+    server.registerTool('search_drive_files', {
+        title: "Find a File in the User's Microsoft Drive",
+        description: DRIVE_SEARCH_DESCRIPTION,
+        inputSchema: DRIVE_SEARCH_INPUT_SCHEMA,
+        annotations: DRIVE_SEARCH_ANNOTATIONS,
+    }, async ({ query, scope, limit, confirm_index, confirm_token }, ctx) => {
+        // A retried multi-round-trip request arrives with the user's answer
+        // embedded. It is checked FIRST and it never searches again: re-running
+        // the query on a retry would spend a second unit of budget and could
+        // return a different set than the one the user was looking at.
+        const embedded = inputResponse(ctx?.mcpReq?.inputResponses, CONFIRM_KEY);
+        if (embedded.kind === 'elicit') {
+            if (embedded.action !== 'accept')
+                return declinedAnswer();
+            const choice = embedded.content
+                ?.choice;
+            return resolvePick(readRequestState(ctx), choice ?? DECLINE_CHOICE);
+        }
+        // The universal lane's confirmation: the model relaying a number the
+        // user said out loud. Same resolution, same server-side lookup.
+        if (confirm_index !== undefined || confirm_token !== undefined) {
+            return resolvePick(confirm_token ?? null, confirm_index ?? NaN);
+        }
+        if (!budget.claim()) {
+            log.warn({
+                event: 'drive_search_capped',
+                searches: budget.spent,
+                budget: budget.ceiling,
+            }, 'drive_search_capped');
+            return toolResult({
+                outcome: 'search_limit_reached',
+                isError: true,
+                text: BUDGET_EXHAUSTED_TEXT,
+                detail: { searchesUsed: budget.spent, searchBudget: budget.ceiling },
+            });
+        }
+        let items;
+        try {
+            const answer = await api.searchDriveFiles({
+                q: query,
+                scope,
+                limit: limit ?? 10,
+            });
+            items = answer.items;
+        }
+        catch (error) {
+            // ORDER MATTERS. Both refusals arrive as `NO_DELEGATED_TOKEN`, so
+            // checking "not connected" first would swallow the administrator
+            // case and hand the user a connect link that Microsoft refuses —
+            // which returns them here, with the same link, forever (ENG-2614).
+            if (isAdminConsentRequired(error)) {
+                return toolResult({
+                    outcome: 'microsoft_admin_approval_required',
+                    text: ADMIN_CONSENT_TEXT,
+                    isError: true,
+                });
+            }
+            if (isNoDelegatedToken(error))
+                return connectAnswer(api);
+            const { outcome, message } = classifyDriveSearchFailure(error);
+            return toolResult({ outcome, text: message, isError: true });
+        }
+        // Mirrors the backend's own discovery log (`[DRIVE-SEARCH]`): the query
+        // LENGTH, never its text, and a count, never a name. Enough to tell an
+        // empty probe from a real one while reading an incident, and none of the
+        // customer's content.
+        log.info({
+            event: 'drive_search',
+            scope: scope ?? 'search',
+            queryLength: query?.length ?? 0,
+            results: items.length,
+            searches: budget.spent,
+            budget: budget.ceiling,
+        }, 'drive_search');
+        if (items.length === 0) {
+            return toolResult({
+                outcome: 'no_matches',
+                text: 'Microsoft returned no spreadsheets matching that. The search ran ' +
+                    'and came back empty — it did not fail. Ask the user to try a ' +
+                    'different part of the name, or call again with scope="recent" ' +
+                    'to list what they have worked on lately.',
+            });
+        }
+        const candidates = items.map(toCandidate);
+        const nonce = randomUUID();
+        registry.remember(nonce, candidates);
+        return ask(ctx, candidates, nonce);
+    });
+}
+/**
+ * The `NO_DELEGATED_TOKEN` answer: a link the BACKEND built.
+ *
+ * The tool takes no authorize URL, no redirect and no client id, and it never
+ * asks the model to compose one. An MCP tool's arguments are chosen by a model
+ * reading content it did not author, so a caller-supplied sign-in link is a
+ * consent-phishing lever — the user would see a genuine Microsoft consent
+ * screen the whole way while approving somebody else's application. Same
+ * reasoning as `connect_microsoft`, which is where this link comes from.
+ */
+async function connectAnswer(api) {
+    try {
+        const handoff = await api.beginMicrosoftConnect();
+        return toolResult({
+            outcome: 'microsoft_not_connected',
+            text: connectPrompt(handoff.authorizeUrl, handoff.expiresAt),
+            detail: { authorizeUrl: handoff.authorizeUrl },
+        });
+    }
+    catch {
+        return toolResult({
+            outcome: 'microsoft_not_connected',
+            isError: true,
+            text: 'This user has no connected Microsoft account, and Rockhopper could ' +
+                'not produce a sign-in link just now. Ask them to run ' +
+                '`connect_microsoft`, or to paste the workbook link for `enroll_file`. ' +
+                'Do not compose a Microsoft sign-in link yourself.',
+        });
+    }
+}
+//# sourceMappingURL=drive-search.js.map

package/dist/tools/drive-search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drive-search.js","sourceRoot":"","sources":["../../src/tools/drive-search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,aAAa,EACb,aAAa,GAId,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,WAAW,GAEZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,cAAc,EACd,UAAU,EACV,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,UAAU,GACX,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAiB,EACjB,GAAc,EACd,OAAiE;IAEjE,2EAA2E;IAC3E,6EAA6E;IAC7E,mDAAmD;IACnD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAE9D;;;;;;;OAOG;IACH,SAAS,WAAW,CAAC,KAAoB,EAAE,MAAuB;QAChE,IAAI,MAAM,KAAK,cAAc,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,cAAc,EAAE,CAAC;QACvE,IAAI,CAAC,KAAK;YAAE,OAAO,sBAAsB,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAC;IAC3E,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,GAAG,CAChB,GAA8B,EAC9B,UAAgC,EAChC,KAAa;QAEb,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAE1C,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YAC9B,OAAO,aAAa,CAAC;gBACnB,aAAa,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAC5D,YAAY,EAAE,KAAK;aACpB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,KAAK,aAAa,IAAI,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;YACvD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACvE,IAAI,MAAM,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAChC,MAAM,MAAM,GAAI,MAAM,CAAC,OAA2C;wBAChE,EAAE,MAAM,CAAC;oBACX,OAAO,WAAW,CAAC,KAAK,EAAE,MAAM,IAAI,cAAc,CAAC,CAAC;gBACtD,CAAC;gBACD,uEAAuE;gBACvE,sDAAsD;gBACtD,OAAO,cAAc,EAAE,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,sEAAsE;gBACtE,iDAAiD;YACnD,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;YAChB,OAAO,EAAE,YAAY;YACrB,IAAI,EAAE,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC;YAC3C,MAAM,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,2CAA2C;QAClD,WAAW,EAAE,wBAAwB;QACrC,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,wBAAwB;KACtC,EACD,KAAK,EACH,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,EACrD,GAAmB,EACnB,EAAE;QACF,oEAAoE;QACpE,wEAAwE;QACxE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QACzE,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,cAAc,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAI,QAAQ,CAAC,OAA2C;gBAClE,EAAE,MAAM,CAAC;YACX,OAAO,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,cAAc,CAAC,CAAC;QACtE,CAAC;QAED,qEAAqE;QACrE,gEAAgE;QAChE,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC/D,OAAO,WAAW,CAAC,aAAa,IAAI,IAAI,EAAE,aAAa,IAAI,GAAG,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CACN;gBACE,KAAK,EAAE,qBAAqB;gBAC5B,QAAQ,EAAE,MAAM,CAAC,KAAK;gBACtB,MAAM,EAAE,MAAM,CAAC,OAAO;aACvB,EACD,qBAAqB,CACtB,CAAC;YACF,OAAO,UAAU,CAAC;gBAChB,OAAO,EAAE,sBAAsB;gBAC/B,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE;aACrE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC;gBACxC,CAAC,EAAE,KAAK;gBACR,KAAK;gBACL,KAAK,EAAE,KAAK,IAAI,EAAE;aACnB,CAAC,CAAC;YACH,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,iEAAiE;YACjE,iEAAiE;YACjE,mEAAmE;YACnE,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,OAAO,UAAU,CAAC;oBAChB,OAAO,EAAE,mCAAmC;oBAC5C,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;YACL,CAAC;YACD,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAC/D,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,sBAAsB;QACtB,GAAG,CAAC,IAAI,CACN;YACE,KAAK,EAAE,cAAc;YACrB,KAAK,EAAE,KAAK,IAAI,QAAQ;YACxB,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC;YAC/B,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,KAAK;YACtB,MAAM,EAAE,MAAM,CAAC,OAAO;SACvB,EACD,cAAc,CACf,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC;gBAChB,OAAO,EAAE,YAAY;gBACrB,IAAI,EACF,mEAAmE;oBACnE,+DAA+D;oBAC/D,gEAAgE;oBAChE,0CAA0C;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAAC,GAAc;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,qBAAqB,EAAE,CAAC;QAClD,OAAO,UAAU,CAAC;YAChB,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,SAAS,CAAC;YAC5D,MAAM,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;SAC/C,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;YAChB,OAAO,EAAE,yBAAyB;YAClC,OAAO,EAAE,IAAI;YACb,IAAI,EACF,qEAAqE;gBACrE,uDAAuD;gBACvD,wEAAwE;gBACxE,mDAAmD;SACtD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/tools/enroll-file.contract.d.ts

@@ -0,0 +1,52 @@
+/**
+ * ENG-2200 — everything `enroll_file` SAYS, split from everything it DOES
+ * (`enroll-file.ts`).
+ *
+ * The seam is not arbitrary. This half is the only interface a language model
+ * ever sees: it cannot read the handler, so the schema descriptions and the
+ * tool description ARE the contract, and a wrong word here is a behaviour bug
+ * that no type checks. Keeping it apart means it can be reviewed as prose —
+ * and read by a person deciding whether a model would do the right thing —
+ * without the branch logic in the way.
+ */
+import { z } from 'zod';
+import type { EnrollOutcome } from '../enrollment.js';
+export declare const ENROLL_INPUT_SCHEMA: z.ZodObject<{
+    url: z.ZodOptional<z.ZodString>;
+    driveMsId: z.ZodOptional<z.ZodString>;
+    msId: z.ZodOptional<z.ZodString>;
+    share_with: z.ZodOptional<z.ZodEnum<{
+        me: "me";
+        team: "team";
+    }>>;
+    confirm_restore: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const ENROLL_DESCRIPTION: string;
+export declare const ENROLL_ANNOTATIONS: {
+    readonly readOnlyHint: false;
+    readonly destructiveHint: false;
+    readonly idempotentHint: true;
+    readonly openWorldHint: true;
+};
+/** The question the model puts to the user when `share_with` was omitted. */
+export declare const SHARE_QUESTION: string;
+/** The machine-readable half of every answer, so a model can branch on it. */
+export interface EnrollAnswer {
+    outcome: EnrollOutcome;
+    text: string;
+    isError?: boolean;
+    detail?: Record<string, unknown>;
+}
+/**
+ * Render an answer as a tool result: prose for the human, then one JSON line
+ * for the model. Both, because prose alone invites the model to paraphrase a
+ * refusal into a success, and JSON alone gives the user nothing to read.
+ */
+export declare function toolResult(answer: EnrollAnswer): {
+    isError?: true | undefined;
+    content: {
+        type: "text";
+        text: string;
+    }[];
+};
+//# sourceMappingURL=enroll-file.contract.d.ts.map

package/dist/tools/enroll-file.contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll-file.contract.d.ts","sourceRoot":"","sources":["../../src/tools/enroll-file.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,eAAO,MAAM,mBAAmB;;;;;;;;;iBAkD9B,CAAC;AAEH,eAAO,MAAM,kBAAkB,QAqB4C,CAAC;AAE5E,eAAO,MAAM,kBAAkB;;;;;CAQrB,CAAC;AAEX,6EAA6E;AAC7E,eAAO,MAAM,cAAc,QAG+C,CAAC;AAE3E,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY;;;;;;EAW9C"}

package/dist/tools/enroll-file.contract.js

@@ -0,0 +1,105 @@
+/**
+ * ENG-2200 — everything `enroll_file` SAYS, split from everything it DOES
+ * (`enroll-file.ts`).
+ *
+ * The seam is not arbitrary. This half is the only interface a language model
+ * ever sees: it cannot read the handler, so the schema descriptions and the
+ * tool description ARE the contract, and a wrong word here is a behaviour bug
+ * that no type checks. Keeping it apart means it can be reviewed as prose —
+ * and read by a person deciding whether a model would do the right thing —
+ * without the branch logic in the way.
+ */
+import { z } from 'zod';
+export const ENROLL_INPUT_SCHEMA = z.object({
+    url: z
+        .string()
+        .optional()
+        .describe("The workbook's SharePoint or OneDrive address, exactly as copied from " +
+        'the browser bar. Use this whenever the user can paste a link — it is ' +
+        'the only input that names one specific file with no guessing.'),
+    driveMsId: z
+        .string()
+        .optional()
+        .describe('Microsoft drive id. Only for a file already identified by another tool; ' +
+        'must be sent together with `msId`, and never alongside `url`.'),
+    msId: z
+        .string()
+        .optional()
+        .describe('Microsoft drive-item id. Must be sent together with `driveMsId`, and ' +
+        'never alongside `url`.'),
+    /**
+     * Optional in the SCHEMA and required by the HANDLER, deliberately.
+     *
+     * A required field turns an omission into a protocol-level validation error,
+     * and the model then sees a rejection instead of the question it is supposed
+     * to put to the user. D5/D6 say ask every time, so the tool answers an
+     * omission with the question. What it must never do is pick a value:
+     * enrolling privately when the user meant "my team" is invisible until
+     * somebody cannot find the file.
+     */
+    share_with: z
+        .enum(['me', 'team'])
+        .optional()
+        .describe('REQUIRED. Who may see this file: "me" (just the user) or "team" ' +
+        '(everyone on their team). ASK THE USER every time and use their ' +
+        'answer — never assume, never carry an answer over from an earlier ' +
+        'file. Omitting it does not enroll anything; the tool returns the ' +
+        'question to put to them.'),
+    confirm_restore: z
+        .boolean()
+        .optional()
+        .describe('Set to true only after the user has confirmed they want a file they ' +
+        'previously removed to be restored. Ignored otherwise.'),
+});
+export const ENROLL_DESCRIPTION = 'Add a Microsoft Excel workbook to Rockhopper so it can be versioned, ' +
+    "reviewed and tracked. Takes the file's SharePoint or OneDrive link (best), " +
+    'or a `driveMsId` + `msId` pair. ' +
+    'MICROSOFT ONLY — Google Sheets and Drive links are refused. ' +
+    'You MUST ask the user who may see the file and pass their answer as ' +
+    '`share_with` ("me" or "team"); calling without it returns the question ' +
+    'instead of enrolling. ' +
+    'If the file was previously removed from Rockhopper, this reports ' +
+    '`restore_confirmation_required` and changes nothing — ask the user, then ' +
+    'call again with `confirm_restore: true`. ' +
+    'Safe to call again if you lose the answer: a file that is already there ' +
+    'reports `already_enrolled` and is not duplicated. ' +
+    'Use this whenever `search_files` or `list_files` cannot find a file the ' +
+    'user is asking about — a file Rockhopper does not know about is not a ' +
+    'missing file, it is an un-enrolled one. ' +
+    // ENG-2204: the `driveMsId` + `msId` pair has one honest source, and naming
+    // it here is what keeps a model from assembling a pair out of ids it read
+    // somewhere else and enrolling a file the user never named.
+    'If the user cannot produce a link, call `search_drive_files` first, have ' +
+    'them confirm which candidate they meant, and pass the `driveMsId` + `msId` ' +
+    'that confirmation returned. Never enroll a file the user has not named.';
+export const ENROLL_ANNOTATIONS = {
+    readOnlyHint: false,
+    // Enrolling adds a file; it never removes or overwrites one, and a repeat
+    // call on an already-enrolled file changes nothing.
+    destructiveHint: false,
+    idempotentHint: true,
+    // It reaches SharePoint / OneDrive through Rockhopper.
+    openWorldHint: true,
+};
+/** The question the model puts to the user when `share_with` was omitted. */
+export const SHARE_QUESTION = 'Before this file can be added, ask the user: "Should this workbook be ' +
+    'visible to just you, or to your whole team?" Then call `enroll_file` again ' +
+    'with share_with="me" or share_with="team". Nothing has been added yet.';
+/**
+ * Render an answer as a tool result: prose for the human, then one JSON line
+ * for the model. Both, because prose alone invites the model to paraphrase a
+ * refusal into a success, and JSON alone gives the user nothing to read.
+ */
+export function toolResult(answer) {
+    const payload = { outcome: answer.outcome, ...(answer.detail ?? {}) };
+    return {
+        content: [
+            {
+                type: 'text',
+                text: `${answer.text}\n${JSON.stringify(payload)}`,
+            },
+        ],
+        ...(answer.isError ? { isError: true } : {}),
+    };
+}
+//# sourceMappingURL=enroll-file.contract.js.map

package/dist/tools/enroll-file.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll-file.contract.js","sourceRoot":"","sources":["../../src/tools/enroll-file.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE;QACtE,uEAAuE;QACvE,+DAA+D,CAClE;IACH,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,0EAA0E;QACxE,+DAA+D,CAClE;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,uEAAuE;QACrE,wBAAwB,CAC3B;IACH;;;;;;;;;OASG;IACH,UAAU,EAAE,CAAC;SACV,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;SACpB,QAAQ,EAAE;SACV,QAAQ,CACP,kEAAkE;QAChE,kEAAkE;QAClE,oEAAoE;QACpE,mEAAmE;QACnE,0BAA0B,CAC7B;IACH,eAAe,EAAE,CAAC;SACf,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,sEAAsE;QACpE,uDAAuD,CAC1D;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,uEAAuE;IACvE,6EAA6E;IAC7E,kCAAkC;IAClC,8DAA8D;IAC9D,sEAAsE;IACtE,yEAAyE;IACzE,wBAAwB;IACxB,mEAAmE;IACnE,2EAA2E;IAC3E,2CAA2C;IAC3C,0EAA0E;IAC1E,oDAAoD;IACpD,0EAA0E;IAC1E,wEAAwE;IACxE,0CAA0C;IAC1C,4EAA4E;IAC5E,0EAA0E;IAC1E,4DAA4D;IAC5D,2EAA2E;IAC3E,6EAA6E;IAC7E,yEAAyE,CAAC;AAE5E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,YAAY,EAAE,KAAK;IACnB,0EAA0E;IAC1E,oDAAoD;IACpD,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,IAAI;IACpB,uDAAuD;IACvD,aAAa,EAAE,IAAI;CACX,CAAC;AAEX,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GACzB,wEAAwE;IACxE,6EAA6E;IAC7E,wEAAwE,CAAC;AAU3E;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAoB;IAC7C,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;IACtE,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAe;gBACrB,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;aACnD;SACF;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/tools/enroll-file.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/server';
+import type { ApiClient } from '../api-client.js';
+export declare function registerEnrollFileTool(server: McpServer, api: ApiClient): void;
+//# sourceMappingURL=enroll-file.d.ts.map

package/dist/tools/enroll-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll-file.d.ts","sourceRoot":"","sources":["../../src/tools/enroll-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAmDlD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,IAAI,CA2N9E"}

package/dist/tools/enroll-file.js

@@ -0,0 +1,184 @@
+import { classifyEnrollmentFailure, describeServerOutcome, outcomeForState, resolveTeamShareTargets, TeamUnresolvedError, } from '../enrollment.js';
+import { ENROLL_ANNOTATIONS, ENROLL_DESCRIPTION, ENROLL_INPUT_SCHEMA, SHARE_QUESTION, toolResult, } from './enroll-file.contract.js';
+export function registerEnrollFileTool(server, api) {
+    /**
+     * Turn whichever input arrived into `(identity, current state)`.
+     *
+     * Both branches learn the state BEFORE writing anything, because the whole
+     * point of the tool is that `enrolled`, `hidden` and `not_enrolled` lead to
+     * three different conversations.
+     */
+    async function resolveTarget(args) {
+        if (args.url) {
+            const resolved = await api.resolveEnrollmentUrl(args.url);
+            return {
+                msId: resolved.msId,
+                driveMsId: resolved.driveMsId,
+                name: resolved.name,
+                state: resolved.enrollmentState,
+            };
+        }
+        const msId = args.msId;
+        const driveMsId = args.driveMsId;
+        const [info] = await api.getEnrollmentInfo([msId]);
+        return {
+            msId,
+            driveMsId,
+            // The bulk read withholds `name` for a hidden or stub row, and an id
+            // enroll has no other source for it. The backend fills the real name
+            // from Graph during the enroll, so an empty string here is a placeholder
+            // that never reaches a user, not a guess at what the file is called.
+            name: info?.name ?? '',
+            state: info?.enrollmentState ?? 'not_enrolled',
+        };
+    }
+    /**
+     * ENG-2536 — the server's own verdict, or null when it did not give one.
+     *
+     * Null is not hypothetical: this package publishes to npm on its own clock
+     * and a customer's `npx` picks up `latest` immediately, so a backend that
+     * predates the field is a live case. The caller falls back to what the
+     * pre-write lookup said, which is exactly the behaviour that shipped before.
+     */
+    function serverOutcomeOf(queued, target) {
+        const files = queued.files ?? [];
+        const mine = files.find((f) => f.msId === target.msId || f.platformId === target.msId) ??
+            (files.length === 1 ? files[0] : undefined);
+        return mine?.outcome ?? null;
+    }
+    async function enroll(target, shareWith) {
+        const file = {
+            msId: target.msId,
+            driveMsId: target.driveMsId,
+            name: target.name,
+        };
+        if (shareWith === 'me') {
+            const queued = await api.createEnrolledFile(file);
+            return {
+                enrollmentId: queued.enrollmentId,
+                sharedWith: 0,
+                serverOutcome: serverOutcomeOf(queued, target),
+            };
+        }
+        const targets = await resolveTeamShareTargets(api);
+        const queued = await api.enrollFileSharedWith(file, targets);
+        return {
+            enrollmentId: queued.enrollmentId,
+            sharedWith: targets.length,
+            serverOutcome: serverOutcomeOf(queued, target),
+        };
+    }
+    server.registerTool('enroll_file', {
+        title: 'Add a File to Rockhopper',
+        description: ENROLL_DESCRIPTION,
+        inputSchema: ENROLL_INPUT_SCHEMA,
+        annotations: ENROLL_ANNOTATIONS,
+    }, async ({ url, driveMsId, msId, share_with, confirm_restore }) => {
+        const hasUrl = !!url?.trim();
+        const hasIds = !!msId?.trim() && !!driveMsId?.trim();
+        if (hasUrl && hasIds) {
+            return toolResult({
+                outcome: 'unresolvable',
+                isError: true,
+                text: 'Send either `url` or the `driveMsId` + `msId` pair, not both — ' +
+                    'they can name different files and Rockhopper will not guess ' +
+                    'which one you meant. Nothing was changed.',
+            });
+        }
+        if (!hasUrl && !hasIds) {
+            return toolResult({
+                outcome: 'unresolvable',
+                isError: true,
+                text: 'No file was named. Ask the user to open the workbook and paste ' +
+                    'the address from their browser bar, then call `enroll_file` with ' +
+                    'that `url`. Nothing was changed.',
+            });
+        }
+        // Checked BEFORE the resolve so an omitted `share_with` costs no network
+        // call and, more importantly, cannot be answered by a half-done enroll.
+        if (share_with === undefined) {
+            return toolResult({
+                outcome: 'share_with_required',
+                text: SHARE_QUESTION,
+            });
+        }
+        let target;
+        try {
+            target = await resolveTarget({ url, driveMsId, msId });
+        }
+        catch (error) {
+            const { outcome, message } = classifyEnrollmentFailure(error);
+            return toolResult({
+                outcome: outcome === 'error' ? 'unresolvable' : outcome,
+                text: outcome === 'error'
+                    ? `Rockhopper could not look that file up: ${message}`
+                    : message,
+                isError: true,
+            });
+        }
+        const known = outcomeForState(target.state);
+        if (known === 'already_enrolled') {
+            return toolResult({
+                outcome: 'already_enrolled',
+                text: `"${target.name}" is already in Rockhopper — nothing to do. Its ` +
+                    'versions and history are available through `get_file_versions` ' +
+                    'and `get_cell_history`.',
+                detail: { fileMsId: target.msId, name: target.name },
+            });
+        }
+        if (known === 'restore_confirmation_required' && !confirm_restore) {
+            return toolResult({
+                outcome: 'restore_confirmation_required',
+                text: `"${target.name || 'That workbook'}" was previously removed from ` +
+                    'Rockhopper\'s file lists. Its versions, comments and history were ' +
+                    'kept. Ask the user whether they want it restored, and if they do, ' +
+                    'call `enroll_file` again with the same arguments plus ' +
+                    'confirm_restore: true. Nothing has been changed.',
+                detail: { fileMsId: target.msId, name: target.name || null },
+            });
+        }
+        const restoring = known === 'restore_confirmation_required';
+        try {
+            const { enrollmentId, sharedWith, serverOutcome } = await enroll(target, share_with);
+            const who = share_with === 'team'
+                ? ` and shared with ${sharedWith} teammate(s)`
+                : ' — visible to you only';
+            // ENG-2536: the SERVER's verdict wins over the one inferred from the
+            // lookup taken before the write. The two can disagree, and when they
+            // do the server is right: the lookup happened earlier, so a file
+            // somebody else added in between reads `not_enrolled` here and would
+            // otherwise be reported as a fresh add. The fallback is what shipped
+            // before, for a backend older than the field.
+            const { outcome, text } = describeServerOutcome(serverOutcome ?? (restoring ? 'restored' : 'enrolled'), target.name, who);
+            return toolResult({
+                outcome,
+                text,
+                detail: {
+                    fileMsId: target.msId,
+                    name: target.name || null,
+                    enrollmentId,
+                    shareWith: share_with,
+                    sharedWithCount: sharedWith,
+                },
+            });
+        }
+        catch (error) {
+            if (error instanceof TeamUnresolvedError) {
+                return toolResult({
+                    outcome: 'share_with_required',
+                    text: error.message,
+                    isError: true,
+                });
+            }
+            const { outcome, message } = classifyEnrollmentFailure(error);
+            return toolResult({
+                outcome: outcome === 'error' ? 'unresolvable' : outcome,
+                text: outcome === 'error'
+                    ? `Rockhopper could not add that file: ${message}`
+                    : message,
+                isError: true,
+            });
+        }
+    });
+}
+//# sourceMappingURL=enroll-file.js.map

package/dist/tools/enroll-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll-file.js","sourceRoot":"","sources":["../../src/tools/enroll-file.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,eAAe,EACf,uBAAuB,EACvB,mBAAmB,GAEpB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,UAAU,GACX,MAAM,2BAA2B,CAAC;AA+BnC,MAAM,UAAU,sBAAsB,CAAC,MAAiB,EAAE,GAAc;IACtE;;;;;;OAMG;IACH,KAAK,UAAU,aAAa,CAAC,IAI5B;QACC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,KAAK,EAAE,QAAQ,CAAC,eAAe;aAChC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAc,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAmB,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,OAAO;YACL,IAAI;YACJ,SAAS;YACT,qEAAqE;YACrE,qEAAqE;YACrE,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE;YACtB,KAAK,EAAE,IAAI,EAAE,eAAe,IAAI,cAAc;SAC/C,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,eAAe,CACtB,MAAwB,EACxB,MAAc;QAEd,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC;YACzE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,MAAM,CACnB,MAAc,EACd,SAAoB;QAMpB,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;SAClB,CAAC;QACF,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAClD,OAAO;gBACL,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,CAAC;gBACb,aAAa,EAAE,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC;aAC/C,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7D,OAAO;YACL,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,OAAO,CAAC,MAAM;YAC1B,aAAa,EAAE,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,aAAa,EACb;QACE,KAAK,EAAE,0BAA0B;QACjC,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EAAE,mBAAmB;QAChC,WAAW,EAAE,kBAAkB;KAChC,EACD,KAAK,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,EAAE;QAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;QAErD,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;YACrB,OAAO,UAAU,CAAC;gBAChB,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,IAAI;gBACb,IAAI,EACF,iEAAiE;oBACjE,8DAA8D;oBAC9D,2CAA2C;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC;gBAChB,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,IAAI;gBACb,IAAI,EACF,iEAAiE;oBACjE,mEAAmE;oBACnE,kCAAkC;aACrC,CAAC,CAAC;QACL,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC;gBAChB,OAAO,EAAE,qBAAqB;gBAC9B,IAAI,EAAE,cAAc;aACrB,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAC9D,OAAO,UAAU,CAAC;gBAChB,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;gBACvD,IAAI,EACF,OAAO,KAAK,OAAO;oBACjB,CAAC,CAAC,2CAA2C,OAAO,EAAE;oBACtD,CAAC,CAAC,OAAO;gBACb,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,KAAK,KAAK,kBAAkB,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC;gBAChB,OAAO,EAAE,kBAAkB;gBAC3B,IAAI,EACF,IAAI,MAAM,CAAC,IAAI,kDAAkD;oBACjE,iEAAiE;oBACjE,yBAAyB;gBAC3B,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,KAAK,+BAA+B,IAAI,CAAC,eAAe,EAAE,CAAC;YAClE,OAAO,UAAU,CAAC;gBAChB,OAAO,EAAE,+BAA+B;gBACxC,IAAI,EACF,IAAI,MAAM,CAAC,IAAI,IAAI,eAAe,gCAAgC;oBAClE,oEAAoE;oBACpE,oEAAoE;oBACpE,wDAAwD;oBACxD,kDAAkD;gBACpD,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,SAAS,GAAG,KAAK,KAAK,+BAA+B,CAAC;QAE5D,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAC9D,MAAM,EACN,UAAU,CACX,CAAC;YACF,MAAM,GAAG,GACP,UAAU,KAAK,MAAM;gBACnB,CAAC,CAAC,oBAAoB,UAAU,cAAc;gBAC9C,CAAC,CAAC,wBAAwB,CAAC;YAC/B,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,qEAAqE;YACrE,qEAAqE;YACrE,8CAA8C;YAC9C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,qBAAqB,CAC7C,aAAa,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,EACtD,MAAM,CAAC,IAAI,EACX,GAAG,CACJ,CAAC;YACF,OAAO,UAAU,CAAC;gBAChB,OAAO;gBACP,IAAI;gBACJ,MAAM,EAAE;oBACN,QAAQ,EAAE,MAAM,CAAC,IAAI;oBACrB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;oBACzB,YAAY;oBACZ,SAAS,EAAE,UAAU;oBACrB,eAAe,EAAE,UAAU;iBAC5B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;gBACzC,OAAO,UAAU,CAAC;oBAChB,OAAO,EAAE,qBAAqB;oBAC9B,IAAI,EAAE,KAAK,CAAC,OAAO;oBACnB,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAC9D,OAAO,UAAU,CAAC;gBAChB,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO;gBACvD,IAAI,EACF,OAAO,KAAK,OAAO;oBACjB,CAAC,CAAC,uCAAuC,OAAO,EAAE;oBAClD,CAAC,CAAC,OAAO;gBACb,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAY5B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,8BAA8B,EAC9B,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAcD,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,aAAa,EAAE,CAUjB;AAWD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,SAAS,EACd,OAAO,CAAC,EAAE,oBAAoB,GAC7B,IAAI,CAcN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAc5B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,8BAA8B,EAC9B,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAcD,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,CAAC,EAAE,oBAAoB,GAC7B,aAAa,EAAE,CAUjB;AAWD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,SAAS,EACd,OAAO,CAAC,EAAE,oBAAoB,GAC7B,IAAI,CAwBN"}

package/dist/tools/index.js

@@ -5,6 +5,8 @@ import { registerGetCommentsTool } from './get-comments.js';
 import { registerGetReviewsTool } from './get-reviews.js';
 import { registerGetCellHistoryTool } from './get-cell-history.js';
 import { registerSearchTool } from './search.js';
+import { registerDriveSearchTool } from './drive-search.js';
+import { registerConnectMicrosoftTool } from './connect-microsoft.js';
 import { registerWriteCommentTools } from './write-comments.js';
 import { registerWriteReviewTools } from './write-reviews.js';
 import { registerWriteVersionTools } from './write-versions.js';
@@ -55,6 +57,16 @@ export function registerTools(server, api, options) {
     registerGetReviewsTool(server, api);
     registerGetCellHistoryTool(server, api);
     registerSearchTool(server, api);
+    // ENG-2204 — discovery of files Rockhopper has NEVER seen. On the read floor
+    // for the same reason `connect_microsoft` is: finding a file writes nothing,
+    // and a read-only token is exactly the caller who needs to be told a file is
+    // un-enrolled rather than missing.
+    registerDriveSearchTool(server, api);
+    // ENG-2198 — connecting a Microsoft account is an account action, not a
+    // write to Rockhopper data, so it rides with the read floor: a read-only
+    // token can still connect, check and disconnect. The backend requires an
+    // interactive login for the disconnect itself.
+    registerConnectMicrosoftTool(server, api);
     // Write tools — one registrar per granted family, so a token holding
     // `comments:write` alone cannot reach `discard_changes`.
     for (const capability of resolveCapabilities(options)) {

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EACd,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,8BAA8B,GAE/B,MAAM,oBAAoB,CAAC;AAiC5B;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAElE,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,OAAO,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA8B;IAE9B,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CACpD,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CACtB,CACF,CAAC;QACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,GAEZ;IACF,gBAAgB,EAAE,yBAAyB;IAC3C,eAAe,EAAE,wBAAwB;IACzC,gBAAgB,EAAE,yBAAyB;IAC3C,aAAa,EAAE,qBAAqB;CACrC,CAAC;AAEF,MAAM,UAAU,aAAa,CAC3B,MAAiB,EACjB,GAAc,EACd,OAA8B;IAE9B,0EAA0E;IAC1E,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhC,qEAAqE;IACrE,yDAAyD;IACzD,KAAK,MAAM,UAAU,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,cAAc,EACd,gBAAgB,GAEjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,yBAAyB,EACzB,8BAA8B,GAE/B,MAAM,oBAAoB,CAAC;AAiC5B;;;;;;;;;GASG;AACH,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAElE,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,KAAyB;IACxD,OAAO,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA8B;IAE9B,IAAI,OAAO,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CACpD,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CACtB,CACF,CAAC;QACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,GAEZ;IACF,gBAAgB,EAAE,yBAAyB;IAC3C,eAAe,EAAE,wBAAwB;IACzC,gBAAgB,EAAE,yBAAyB;IAC3C,aAAa,EAAE,qBAAqB;CACrC,CAAC;AAEF,MAAM,UAAU,aAAa,CAC3B,MAAiB,EACjB,GAAc,EACd,OAA8B;IAE9B,0EAA0E;IAC1E,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnC,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,sBAAsB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpC,0BAA0B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACxC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,mCAAmC;IACnC,uBAAuB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrC,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,+CAA+C;IAC/C,4BAA4B,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAE1C,qEAAqE;IACrE,yDAAyD;IACzD,KAAK,MAAM,UAAU,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/tools/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../src/tools/search.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAOlD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,SAAS,GACb,IAAI,CAuNN"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../src/tools/search.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAOlD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,SAAS,GACb,IAAI,CA8ON"}