@runcofactor/cli 0.10.0

package/dist/mcp-54IJEOUA.js

@@ -0,0 +1,1956 @@
+import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
+import {
+  diffSnapshots,
+  fromApiSnapshot
+} from "./chunk-JDBCZ3Z2.js";
+import {
+  LocalBrowserHost,
+  USER_PAUSED_ERROR
+} from "./chunk-I4QLI3JO.js";
+import {
+  callTool,
+  createSession,
+  deleteAllSessions,
+  deleteSession,
+  resolveTargetSession
+} from "./chunk-J6SH7GQT.js";
+import {
+  fetchOrgs,
+  openUrl,
+  switchOrg
+} from "./chunk-QFDOWABX.js";
+import {
+  clearUpdateCache
+} from "./chunk-N7HFALX3.js";
+import {
+  packageName
+} from "./chunk-JICSYFRJ.js";
+import {
+  ENV_URLS,
+  envToProfile,
+  readStoredToken,
+  resolveAppUrl,
+  saveAuth
+} from "./chunk-A4OFTUVV.js";
+import {
+  getBrowserToolDefinitionsWithLifecycle
+} from "./chunk-4PNOV7OV.js";
+import "./chunk-JWHYXEA2.js";
+import "./chunk-6LEZCKKV.js";
+import "./chunk-ZD3KHESI.js";
+import "./chunk-VKVL7WBN.js";
+
+// src/mcp/index.ts
+import process4 from "process";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+
+// ../mcp-tools/src/context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var storage = new AsyncLocalStorage();
+function withToolCtx(ctx, fn) {
+  return storage.run(ctx, fn);
+}
+function currentToolCtx() {
+  return storage.getStore();
+}
+
+// ../mcp-tools/src/api-client.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+async function mcpApiRequest(method, path, body) {
+  const ctx = currentToolCtx();
+  if (!ctx) {
+    throw new Error("[no-context] mcpApiRequest called outside of withToolCtx()");
+  }
+  const url = `${ctx.apiUrl}${path}`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers: {
+        Authorization: `Bearer ${ctx.apiToken}`,
+        "Content-Type": "application/json"
+      },
+      signal: AbortSignal.timeout(DEFAULT_TIMEOUT_MS),
+      ...body ? { body: JSON.stringify(body) } : {}
+    });
+  } catch (err) {
+    if (err instanceof Error && err.name === "TimeoutError") {
+      throw new Error(`[timeout] upstream API did not respond within ${DEFAULT_TIMEOUT_MS}ms`);
+    }
+    throw new Error(`[network] ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!res.ok) {
+    if (res.status === 401) {
+      throw new Error("[unauthorized] Your session may have expired.");
+    }
+    const text = await res.text().catch(() => "");
+    throw new Error(`[http-${res.status}] ${text || res.statusText}`);
+  }
+  return await res.json();
+}
+
+// ../mcp-tools/src/tool-helpers.ts
+function toolText(text) {
+  return { content: [{ type: "text", text }] };
+}
+function toolJson(data) {
+  return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+}
+
+// ../mcp-tools/src/registry.ts
+function buildRegistry(groups) {
+  return {
+    list() {
+      return groups.flatMap((g) => g.definitions());
+    },
+    async call(tool, args, ctx) {
+      return withToolCtx(ctx, async () => {
+        for (const group of groups) {
+          const result = await group.handle(tool, args);
+          if (result) return result;
+        }
+        return toolText(`Unknown tool: ${tool}`);
+      });
+    }
+  };
+}
+
+// ../mcp-tools/src/groups/workflows.ts
+function getWorkflowToolDefinitions() {
+  return [
+    {
+      name: "canary_workflow_list",
+      description: "List workflows in the current organization. Supports filtering by name, type, and status with pagination.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          search: {
+            type: "string",
+            description: "Search workflows by name"
+          },
+          flowType: {
+            type: "string",
+            enum: ["standard", "setup", "seed", "teardown"],
+            description: "Filter by flow type"
+          },
+          status: {
+            type: "string",
+            enum: ["draft", "published"],
+            description: "Filter by lifecycle status. 'draft' = editable, not run by suites. 'published' = active, included in regression runs. Reliability (passing/flaky/degraded) is the separate `health` dimension."
+          },
+          page: {
+            type: "number",
+            description: "Page number (default: 1)"
+          },
+          pageSize: {
+            type: "number",
+            description: "Page size (default: 25)"
+          }
+        }
+      }
+    },
+    {
+      name: "canary_workflow_get",
+      description: "Get a workflow definition with its steps, nodes, and configuration details.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: {
+            type: "string",
+            description: "The workflow UUID"
+          }
+        },
+        required: ["workflowId"]
+      }
+    },
+    {
+      name: "canary_workflow_patch",
+      description: "Update workflow properties using merge-patch. Only provided fields are updated; omitted fields are left unchanged.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: {
+            type: "string",
+            description: "The workflow UUID"
+          },
+          name: {
+            type: "string",
+            description: "New workflow name"
+          },
+          description: {
+            type: "string",
+            description: "New description"
+          },
+          status: {
+            type: "string",
+            enum: ["draft", "published"],
+            description: "New lifecycle status. 'draft' = editable, not run by suites. 'published' = active, included in regression runs. Reliability is tracked automatically by the `health` dimension; a flow that keeps failing becomes `degraded` and is skipped in suites until edited or re-enabled."
+          },
+          flowType: {
+            type: "string",
+            enum: ["standard", "setup", "seed", "teardown"],
+            description: "New flow type"
+          }
+        },
+        required: ["workflowId"]
+      }
+    },
+    {
+      name: "canary_workflow_run",
+      description: "Trigger a workflow execution. Returns the run ID for tracking status via canary_workflow_runs_get.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: {
+            type: "string",
+            description: "The workflow UUID to execute"
+          }
+        },
+        required: ["workflowId"]
+      }
+    },
+    {
+      name: "canary_workflow_sync",
+      description: "Atomically replace all nodes and edges in a workflow. Automatically creates a draft snapshot of the current state before overwriting so changes can be reverted. Use canary_workflow_get to read the current DAG first, modify nodes/edges, then sync back. When using propose=true on an existing workflow, REUSE each existing node's `id` for steps you keep (omit `id` only for genuinely new steps). Without ID reuse the proposal will diff as a full rewrite \u2014 every step shown as Removed+Added in the review UI even when only configs changed.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: {
+            type: "string",
+            description: "The workflow UUID"
+          },
+          nodes: {
+            type: "array",
+            description: "Array of node objects with id, nodeType, orderIndex, configJson",
+            items: { type: "object" }
+          },
+          edges: {
+            type: "array",
+            description: "Array of edge objects with id, sourceNodeId, targetNodeId, edgeType",
+            items: { type: "object" }
+          },
+          createSnapshot: {
+            type: "boolean",
+            description: "Create a draft snapshot before syncing (default: true)",
+            default: true
+          },
+          propose: {
+            type: "boolean",
+            description: "Create a proposal instead of applying directly. The proposal can be reviewed and accepted/rejected via the UI. IMPORTANT: when proposing on an existing workflow, reuse each existing node's `id` for steps you intend to keep \u2014 only omit `id` for genuinely new steps. Otherwise the diff will show every step as Removed+Added.",
+            default: false
+          },
+          proposalTitle: {
+            type: "string",
+            description: "Title for the proposal (used with propose: true)"
+          },
+          proposalDescription: {
+            type: "string",
+            description: "Description/rationale for the proposal (used with propose: true)"
+          }
+        },
+        required: ["workflowId", "nodes", "edges"]
+      }
+    }
+  ];
+}
+async function handleWorkflowTool(tool, args) {
+  if (tool === "canary_workflow_list") {
+    try {
+      const params = new URLSearchParams();
+      if (args.search) params.set("search", String(args.search));
+      if (args.flowType) params.set("flowType", String(args.flowType));
+      if (args.status) params.set("status", String(args.status));
+      if (args.page) params.set("page", String(args.page));
+      if (args.pageSize) params.set("pageSize", String(args.pageSize));
+      const qs = params.toString();
+      const path = `/workflows${qs ? `?${qs}` : ""}`;
+      const result = await mcpApiRequest("GET", path);
+      if (!result.ok) {
+        return toolJson({ ok: false, error: result.error ?? "Unknown error" });
+      }
+      return toolJson({ ok: true, data: result.data, pagination: result.pagination });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_workflow_get") {
+    try {
+      const workflowId = args.workflowId;
+      const result = await mcpApiRequest("GET", `/workflows/${workflowId}`);
+      if (result.error) {
+        return toolJson({ ok: false, error: result.error });
+      }
+      return toolJson({ ok: true, workflow: result.workflow });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_workflow_patch") {
+    try {
+      const workflowId = args.workflowId;
+      const body = {};
+      if (args.name) body.name = String(args.name);
+      if (args.description) body.description = String(args.description);
+      if (args.status) body.status = String(args.status);
+      if (args.flowType) body.flowType = String(args.flowType);
+      const result = await mcpApiRequest("PUT", `/workflows/${workflowId}`, body);
+      if (result.error) {
+        return toolJson({ ok: false, error: result.error });
+      }
+      return toolJson({ ok: true, workflow: result.workflow });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_workflow_run") {
+    try {
+      const workflowId = args.workflowId;
+      const result = await mcpApiRequest("POST", `/workflows/${workflowId}/execute`);
+      if (result.error) {
+        return toolJson({ ok: false, error: result.error });
+      }
+      return toolJson({ ok: true, runId: result.runId, streamId: result.streamId });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_workflow_sync") {
+    try {
+      const workflowId = args.workflowId;
+      const nodes = args.nodes;
+      const edges = args.edges;
+      if (args.propose) {
+        const title = args.proposalTitle ?? `Sync proposal (${nodes.length} nodes)`;
+        const description = args.proposalDescription ?? null;
+        const result2 = await mcpApiRequest("POST", `/workflows/${workflowId}/proposals`, {
+          title,
+          description,
+          snapshotJson: { nodes, edges },
+          source: "api"
+        });
+        if (result2.error) {
+          return toolJson({ ok: false, error: result2.error });
+        }
+        return toolJson({
+          ok: true,
+          proposalId: result2.data?.id,
+          title: result2.data?.title,
+          status: result2.data?.status
+        });
+      }
+      const createSnapshot = args.createSnapshot !== false;
+      const result = await mcpApiRequest("PUT", `/workflows/${workflowId}/draft-state`, {
+        nodes,
+        edges,
+        createSnapshot
+      });
+      if (result.error) {
+        return toolJson({ ok: false, error: result.error });
+      }
+      return toolJson({
+        ok: true,
+        ...result.snapshotVersion ? { snapshotVersion: result.snapshotVersion } : {}
+      });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return null;
+}
+
+// ../mcp-tools/src/groups/workflow-proposals.ts
+function getWorkflowProposalsToolDefinitions() {
+  return [
+    {
+      name: "canary_workflow_proposals_list",
+      description: 'List workflow proposals. By default returns pending proposals; pass status="all" for every status.',
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: { type: "string", description: "Workflow UUID" },
+          status: {
+            type: "string",
+            enum: ["pending", "accepted", "rejected", "stale", "all"],
+            description: "Filter by status (default: pending)"
+          }
+        },
+        required: ["workflowId"]
+      }
+    },
+    {
+      name: "canary_workflow_proposals_get",
+      description: "Fetch a proposal including its full snapshot JSON.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: { type: "string" },
+          proposalId: { type: "string" }
+        },
+        required: ["workflowId", "proposalId"]
+      }
+    },
+    {
+      name: "canary_workflow_proposals_diff",
+      description: "Compute a per-node diff between a proposal and the current workflow draft. Returns summary counts plus per-field changes for changed nodes.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: { type: "string" },
+          proposalId: { type: "string" }
+        },
+        required: ["workflowId", "proposalId"]
+      }
+    },
+    {
+      name: "canary_workflow_proposals_accept",
+      description: "Apply a proposal to the workflow draft. Omit acceptedNodeIds for atomic (all-or-nothing) accept; provide it to cherry-pick a subset.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: { type: "string" },
+          proposalId: { type: "string" },
+          acceptedNodeIds: {
+            type: "array",
+            items: { type: "string" },
+            description: "Optional: node ids from the diff to include. Omit for atomic accept of every change."
+          }
+        },
+        required: ["workflowId", "proposalId"]
+      }
+    },
+    {
+      name: "canary_workflow_proposals_reject",
+      description: "Reject a pending proposal. Does not change the workflow draft.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: { type: "string" },
+          proposalId: { type: "string" }
+        },
+        required: ["workflowId", "proposalId"]
+      }
+    },
+    {
+      name: "canary_workflow_proposals_revert",
+      description: "Revert a previously-accepted proposal back to pending. Only the user who accepted it may revert.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: { type: "string" },
+          proposalId: { type: "string" }
+        },
+        required: ["workflowId", "proposalId"]
+      }
+    }
+  ];
+}
+async function handleWorkflowProposalsTool(tool, args) {
+  if (!tool.startsWith("canary_workflow_proposals_")) return null;
+  try {
+    switch (tool) {
+      case "canary_workflow_proposals_list":
+        return await listProposals(args);
+      case "canary_workflow_proposals_get":
+        return await getProposal(args);
+      case "canary_workflow_proposals_diff":
+        return await diffProposal(args);
+      case "canary_workflow_proposals_accept":
+        return await acceptProposal(args);
+      case "canary_workflow_proposals_reject":
+        return await rejectProposal(args);
+      case "canary_workflow_proposals_revert":
+        return await revertProposal(args);
+      default:
+        return null;
+    }
+  } catch (err) {
+    return toolJson({
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
+async function listProposals(args) {
+  const workflowId = String(args.workflowId);
+  const status = typeof args.status === "string" ? args.status : "pending";
+  const query = status === "all" ? "" : `?status=${encodeURIComponent(status)}`;
+  const res = await mcpApiRequest("GET", `/workflows/${workflowId}/proposals${query}`);
+  return toolJson({
+    ok: res.ok,
+    workflowId,
+    count: res.data?.length ?? 0,
+    proposals: res.data ?? [],
+    error: res.error
+  });
+}
+async function getProposal(args) {
+  const workflowId = String(args.workflowId);
+  const proposalId = String(args.proposalId);
+  const res = await mcpApiRequest("GET", `/workflows/${workflowId}/proposals/${proposalId}`);
+  return toolJson(res);
+}
+async function diffProposal(args) {
+  const workflowId = String(args.workflowId);
+  const proposalId = String(args.proposalId);
+  const [propRes, wfRes] = await Promise.all([
+    mcpApiRequest(
+      "GET",
+      `/workflows/${workflowId}/proposals/${proposalId}`
+    ),
+    mcpApiRequest(
+      "GET",
+      `/workflows/${workflowId}`
+    )
+  ]);
+  if (!propRes.ok || !propRes.data) {
+    return toolJson({ ok: false, error: propRes.error ?? "proposal not found" });
+  }
+  if (!wfRes.workflow) {
+    return toolJson({ ok: false, error: wfRes.error ?? "workflow not found" });
+  }
+  const current = fromApiSnapshot({
+    nodes: wfRes.workflow.nodes,
+    edges: wfRes.workflow.edges
+  });
+  const proposed = fromApiSnapshot(propRes.data.snapshotJson);
+  const diff = diffSnapshots(current, proposed);
+  return toolJson(buildDiffPayload(propRes.data, diff));
+}
+async function acceptProposal(args) {
+  const workflowId = String(args.workflowId);
+  const proposalId = String(args.proposalId);
+  const acceptedNodeIds = Array.isArray(args.acceptedNodeIds) ? args.acceptedNodeIds.filter((s) => typeof s === "string") : null;
+  const body = acceptedNodeIds ? { selection: { acceptedNodeIds } } : void 0;
+  const res = await mcpApiRequest(
+    "POST",
+    `/workflows/${workflowId}/proposals/${proposalId}/accept`,
+    body
+  );
+  return toolJson({
+    ...res,
+    workflowId,
+    proposalId,
+    partial: acceptedNodeIds !== null
+  });
+}
+async function rejectProposal(args) {
+  const workflowId = String(args.workflowId);
+  const proposalId = String(args.proposalId);
+  const res = await mcpApiRequest(
+    "POST",
+    `/workflows/${workflowId}/proposals/${proposalId}/reject`
+  );
+  return toolJson({ ...res, workflowId, proposalId });
+}
+async function revertProposal(args) {
+  const workflowId = String(args.workflowId);
+  const proposalId = String(args.proposalId);
+  const res = await mcpApiRequest(
+    "POST",
+    `/workflows/${workflowId}/proposals/${proposalId}/revert`
+  );
+  return toolJson({ ...res, workflowId, proposalId });
+}
+function buildDiffPayload(proposal, diff) {
+  return {
+    proposal: {
+      id: proposal.id,
+      title: proposal.title,
+      source: proposal.source,
+      status: proposal.status,
+      stale: proposal.status === "stale",
+      createdAt: proposal.createdAt,
+      decidedAt: proposal.decidedAt
+    },
+    summary: {
+      addedNodes: diff.addedNodes.length,
+      removedNodes: diff.removedNodes.length,
+      changedNodes: diff.changedNodes.length,
+      addedEdges: diff.addedEdges.length,
+      removedEdges: diff.removedEdges.length,
+      touchedCount: diff.touchedCount,
+      isEmpty: diff.isEmpty
+    },
+    nodes: {
+      added: diff.addedNodes.map((n) => ({
+        id: n.id,
+        nodeType: n.nodeType,
+        configJson: n.configJson
+      })),
+      removed: diff.removedNodes.map((n) => ({
+        id: n.id,
+        nodeType: n.nodeType,
+        configJson: n.configJson
+      })),
+      changed: diff.changedNodes.map((c) => ({
+        id: c.id,
+        nodeType: c.nodeType,
+        typeChanged: c.typeChanged,
+        beforeType: c.beforeType,
+        afterType: c.afterType,
+        fieldChanges: c.fieldChanges
+      }))
+    },
+    edges: {
+      added: diff.addedEdges.map((e) => ({
+        sourceNodeId: e.sourceNodeId,
+        targetNodeId: e.targetNodeId,
+        edgeType: e.edgeType ?? null
+      })),
+      removed: diff.removedEdges.map((e) => ({
+        sourceNodeId: e.sourceNodeId,
+        targetNodeId: e.targetNodeId,
+        edgeType: e.edgeType ?? null
+      }))
+    }
+  };
+}
+
+// ../mcp-tools/src/groups/workflow-runs.ts
+function getWorkflowRunsToolDefinitions() {
+  return [
+    {
+      name: "canary_workflow_runs_list",
+      description: "List runs for a specific workflow with status, duration, and pagination.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: {
+            type: "string",
+            description: "The workflow UUID"
+          },
+          page: {
+            type: "number",
+            description: "Page number (default: 1)"
+          },
+          pageSize: {
+            type: "number",
+            description: "Page size (default: 10)"
+          },
+          mode: {
+            type: "string",
+            enum: ["browser", "api"],
+            description: "Filter by run mode"
+          }
+        },
+        required: ["workflowId"]
+      }
+    },
+    {
+      name: "canary_workflow_runs_get",
+      description: "Get workflow run detail including steps, status, duration, and error messages. Also serves as a status check for in-progress runs.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: {
+            type: "string",
+            description: "The workflow UUID"
+          },
+          runId: {
+            type: "string",
+            description: "The workflow run UUID"
+          }
+        },
+        required: ["workflowId", "runId"]
+      }
+    },
+    {
+      name: "canary_workflow_runs_diagnostics",
+      description: "Get failure diagnostic for a workflow run. Returns AI-generated analysis if available, otherwise falls back to console logs and network requests.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: {
+            type: "string",
+            description: "The workflow UUID"
+          },
+          runId: {
+            type: "string",
+            description: "The workflow run UUID"
+          }
+        },
+        required: ["workflowId", "runId"]
+      }
+    }
+  ];
+}
+async function handleWorkflowRunsTool(tool, args) {
+  if (tool === "canary_workflow_runs_list") {
+    try {
+      const workflowId = args.workflowId;
+      const params = new URLSearchParams();
+      params.set("page", String(args.page ?? 1));
+      params.set("pageSize", String(args.pageSize ?? 10));
+      if (args.mode) params.set("mode", String(args.mode));
+      const result = await mcpApiRequest("GET", `/workflows/${workflowId}/runs?${params}`);
+      if (!result.ok) {
+        return toolJson({ ok: false, error: result.error ?? "Unknown error" });
+      }
+      return toolJson({ ok: true, runs: result.data.runs, pagination: result.pagination });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_workflow_runs_get") {
+    try {
+      const workflowId = args.workflowId;
+      const runId = args.runId;
+      const result = await mcpApiRequest("GET", `/workflows/${workflowId}/runs/${runId}`);
+      if (!result.ok) {
+        return toolJson({ ok: false, error: result.error ?? "Unknown error" });
+      }
+      return toolJson({ ok: true, data: result.data });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_workflow_runs_diagnostics") {
+    try {
+      const workflowId = args.workflowId;
+      const runId = args.runId;
+      const result = await mcpApiRequest("GET", `/workflows/${workflowId}/runs/${runId}/failure-diagnostic`);
+      if (result.ok && result.data) {
+        return toolJson({ ok: true, data: result.data });
+      }
+      const rawResult = await mcpApiRequest("GET", `/workflows/${workflowId}/runs/${runId}/diagnostics`);
+      if (!rawResult.ok) {
+        return toolJson({ ok: true, data: null, message: "No diagnostic available" });
+      }
+      return toolJson({
+        ok: true,
+        consoleLogs: rawResult.consoleLogs,
+        networkRequests: rawResult.networkRequests
+      });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return null;
+}
+
+// ../mcp-tools/src/groups/test-suites.ts
+function getTestSuiteToolDefinitions() {
+  return [
+    {
+      name: "canary_test_suite_run",
+      description: "Trigger a test suite execution. Returns the suite ID and job ID. Use canary_test_suite_get to check results after triggering.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          tag: {
+            type: "string",
+            description: "Filter workflows by tag"
+          },
+          namePattern: {
+            type: "string",
+            description: "Filter workflows by name pattern (regex)"
+          },
+          propertyId: {
+            type: "string",
+            description: "Target a specific property by UUID"
+          },
+          environmentId: {
+            type: "string",
+            description: "Target a specific environment by UUID"
+          }
+        }
+      }
+    },
+    {
+      name: "canary_test_suite_list",
+      description: "List recent test suite executions with pass/fail counts, ordered by most recent first.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          page: {
+            type: "number",
+            description: "Page number (default: 1)"
+          },
+          pageSize: {
+            type: "number",
+            description: "Page size (default: 20)"
+          }
+        }
+      }
+    },
+    {
+      name: "canary_test_suite_get",
+      description: "Get test suite detail including all individual test runs and their results.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          executionId: {
+            type: "string",
+            description: "The test execution UUID"
+          }
+        },
+        required: ["executionId"]
+      }
+    },
+    {
+      name: "canary_test_suite_diagnostics",
+      description: "Get AI-generated failure diagnostic for a specific workflow run, including root cause analysis and recommendations.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: {
+            type: "string",
+            description: "The workflow UUID"
+          },
+          runId: {
+            type: "string",
+            description: "The workflow run UUID"
+          }
+        },
+        required: ["workflowId", "runId"]
+      }
+    },
+    {
+      name: "canary_test_suite_steps",
+      description: "Get the individual steps of a workflow run with their status, duration, and error messages.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          workflowId: {
+            type: "string",
+            description: "The workflow UUID"
+          },
+          runId: {
+            type: "string",
+            description: "The workflow run UUID"
+          }
+        },
+        required: ["workflowId", "runId"]
+      }
+    }
+  ];
+}
+async function handleTestSuiteTool(tool, args) {
+  if (tool === "canary_test_suite_run") {
+    try {
+      const params = new URLSearchParams();
+      if (args.tag) params.set("tag", String(args.tag));
+      if (args.namePattern) params.set("namePattern", String(args.namePattern));
+      const queryStr = params.toString();
+      const path = `/workflows/test-runs${queryStr ? `?${queryStr}` : ""}`;
+      const body = {};
+      if (args.propertyId) body.propertyId = String(args.propertyId);
+      if (args.environmentId) body.environmentId = String(args.environmentId);
+      const data = await mcpApiRequest("POST", path, body);
+      if (!data.ok) {
+        return toolJson({ ok: false, error: data.error ?? "Unknown error" });
+      }
+      return toolJson({
+        ok: true,
+        suiteId: data.suiteId,
+        jobId: data.jobId,
+        appUrl: data.appUrl,
+        message: `Test suite triggered. Use canary_test_suite_get or canary_test_suite_list to check results.`
+      });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_test_suite_list") {
+    try {
+      const params = new URLSearchParams();
+      params.set("page", String(args.page ?? 1));
+      params.set("pageSize", String(args.pageSize ?? 20));
+      params.set("sortBy", "createdAt");
+      params.set("sortOrder", "desc");
+      const result = await mcpApiRequest("GET", `/workflows/test-executions?${params}`);
+      if (!result.ok) {
+        return toolJson({ ok: false, error: result.error ?? "Unknown error" });
+      }
+      return toolJson({ ok: true, data: result.data, pagination: result.pagination });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_test_suite_get") {
+    try {
+      const executionId = args.executionId;
+      const result = await mcpApiRequest("GET", `/workflows/test-executions/${executionId}`);
+      if (!result.ok) {
+        return toolJson({ ok: false, error: result.error ?? "Unknown error" });
+      }
+      return toolJson({ ok: true, execution: result.execution, testRuns: result.testRuns });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_test_suite_diagnostics") {
+    try {
+      const workflowId = args.workflowId;
+      const runId = args.runId;
+      const result = await mcpApiRequest("GET", `/workflows/${workflowId}/runs/${runId}/failure-diagnostic`);
+      if (!result.ok) {
+        return toolJson({ ok: false, error: result.error ?? "Unknown error" });
+      }
+      return toolJson({ ok: true, data: result.data });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_test_suite_steps") {
+    try {
+      const workflowId = args.workflowId;
+      const runId = args.runId;
+      const result = await mcpApiRequest("GET", `/workflows/${workflowId}/runs/${runId}`);
+      if (!result.ok) {
+        return toolJson({ ok: false, error: result.error ?? "Unknown error" });
+      }
+      return toolJson({ ok: true, data: result.data });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return null;
+}
+
+// ../mcp-tools/src/groups/credentials.ts
+function getCredentialToolDefinitions() {
+  return [
+    {
+      name: "canary_credential_list",
+      description: "List credentials in the current organization with their property and environment info.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          property: {
+            type: "string",
+            description: "Filter by property name or ID"
+          }
+        }
+      }
+    }
+  ];
+}
+async function handleCredentialTool(tool, args) {
+  if (tool === "canary_credential_list") {
+    try {
+      const result = await mcpApiRequest("GET", "/org/credentials");
+      let items = result.items ?? [];
+      items = items.filter((c) => !c.isEphemeral);
+      if (args.property) {
+        const filter = String(args.property).toLowerCase();
+        items = items.filter(
+          (c) => c.propertyId === args.property || c.propertyName && c.propertyName.toLowerCase().includes(filter)
+        );
+      }
+      return toolJson({ ok: true, credentials: items });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return null;
+}
+
+// ../mcp-tools/src/groups/issues.ts
+function getIssueToolDefinitions() {
+  return [
+    {
+      name: "canary_issues_list",
+      description: "List and search issues in the current organization. Supports full-text search, severity/status filtering, and pagination.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          search: {
+            type: "string",
+            description: "Full-text search query"
+          },
+          severity: {
+            type: "string",
+            enum: ["low", "medium", "high", "unknown"],
+            description: "Filter by severity level"
+          },
+          statuses: {
+            type: "string",
+            description: "Comma-separated status filter: open, closed, not_a_bug"
+          },
+          propertyId: {
+            type: "string",
+            description: "Filter by property UUID"
+          },
+          page: {
+            type: "number",
+            description: "Page number (default: 1)"
+          },
+          pageSize: {
+            type: "number",
+            description: "Page size (default: 25)"
+          }
+        }
+      }
+    },
+    {
+      name: "canary_issues_get",
+      description: "Get issue detail with diagnostics, including console errors and network failures from the latest occurrence.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          issueId: {
+            type: "string",
+            description: "The issue UUID"
+          }
+        },
+        required: ["issueId"]
+      }
+    }
+  ];
+}
+async function handleIssueTool(tool, args) {
+  if (tool === "canary_issues_list") {
+    try {
+      const params = new URLSearchParams();
+      if (args.search) params.set("search", String(args.search));
+      if (args.severity) params.set("severity", String(args.severity));
+      if (args.statuses) params.set("statuses", String(args.statuses));
+      if (args.propertyId) params.set("propertyId", String(args.propertyId));
+      if (args.page) params.set("page", String(args.page));
+      if (args.pageSize) params.set("pageSize", String(args.pageSize));
+      const qs = params.toString();
+      const path = `/v2/issues${qs ? `?${qs}` : ""}`;
+      const result = await mcpApiRequest("GET", path);
+      if (!result.ok) {
+        return toolJson({ ok: false, error: result.error ?? "Unknown error" });
+      }
+      return toolJson({ ok: true, data: result.data, pagination: result.pagination });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (tool === "canary_issues_get") {
+    try {
+      const issueId = args.issueId;
+      const detailResult = await mcpApiRequest("GET", `/v2/issues/${issueId}`);
+      if (!detailResult.ok) {
+        return toolJson({ ok: false, error: detailResult.error ?? "Unknown error" });
+      }
+      const { issue } = detailResult.data;
+      const occ = issue.latestOccurrence;
+      let consoleErrors = [];
+      let networkErrors = [];
+      if (occ) {
+        try {
+          const [consoleRes, networkRes] = await Promise.all([
+            mcpApiRequest(
+              "GET",
+              `/v2/issues/${issueId}/occurrences/${occ.id}/console-logs`
+            ),
+            mcpApiRequest(
+              "GET",
+              `/v2/issues/${issueId}/occurrences/${occ.id}/network-requests`
+            )
+          ]);
+          if (consoleRes.ok && Array.isArray(consoleRes.data)) {
+            consoleErrors = consoleRes.data.filter(
+              (e) => e.type === "error"
+            );
+          }
+          if (networkRes.ok && Array.isArray(networkRes.data)) {
+            networkErrors = networkRes.data.filter(
+              (e) => e.status === null || e.status === 0 || e.status !== null && e.status >= 400
+            );
+          }
+        } catch {
+        }
+      }
+      return toolJson({
+        ok: true,
+        ...detailResult.data,
+        consoleErrors,
+        networkErrors
+      });
+    } catch (err) {
+      return toolJson({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  return null;
+}
+
+// ../mcp-tools/src/groups/index.ts
+var workflowsGroup = {
+  id: "workflows",
+  definitions: getWorkflowToolDefinitions,
+  handle: (tool, args) => handleWorkflowTool(tool, args)
+};
+var workflowProposalsGroup = {
+  id: "workflow-proposals",
+  definitions: getWorkflowProposalsToolDefinitions,
+  handle: (tool, args) => handleWorkflowProposalsTool(tool, args)
+};
+var workflowRunsGroup = {
+  id: "workflow-runs",
+  definitions: getWorkflowRunsToolDefinitions,
+  handle: (tool, args) => handleWorkflowRunsTool(tool, args)
+};
+var testSuitesGroup = {
+  id: "test-suites",
+  definitions: getTestSuiteToolDefinitions,
+  handle: (tool, args) => handleTestSuiteTool(tool, args)
+};
+var credentialsGroup = {
+  id: "credentials",
+  definitions: getCredentialToolDefinitions,
+  handle: (tool, args) => handleCredentialTool(tool, args)
+};
+var issuesGroup = {
+  id: "issues",
+  definitions: getIssueToolDefinitions,
+  handle: (tool, args) => handleIssueTool(tool, args)
+};
+var sharedGroups = [
+  workflowsGroup,
+  workflowProposalsGroup,
+  workflowRunsGroup,
+  testSuitesGroup,
+  credentialsGroup,
+  issuesGroup
+];
+
+// src/mcp/api-url.ts
+import process from "process";
+var DEFAULT_API_URL = "https://api.trycanary.ai";
+function resolveApiUrl() {
+  return process.env.CANARY_API_URL ?? DEFAULT_API_URL;
+}
+
+// src/mcp/tool-helpers.ts
+function toolText2(text) {
+  return { content: [{ type: "text", text }] };
+}
+function toolJson2(data) {
+  return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
+}
+function formatMCPContent(result) {
+  if (typeof result === "string") {
+    return { content: [{ type: "text", text: result }] };
+  }
+  const content = [];
+  if (result.text) {
+    content.push({ type: "text", text: result.text });
+  }
+  for (const img of result.images ?? []) {
+    content.push({ type: "image", data: img.data, mimeType: img.mimeType });
+  }
+  return { content };
+}
+
+// src/mcp/session-tools.ts
+import process2 from "process";
+var browserSessions = /* @__PURE__ */ new Map();
+var DEFAULT_API_URL2 = "https://api.trycanary.ai";
+function resolveApiUrl2(input) {
+  return input ?? process2.env.CANARY_API_URL ?? DEFAULT_API_URL2;
+}
+async function resolveToken() {
+  const token = process2.env.CANARY_API_TOKEN ?? await readStoredToken();
+  if (!token) {
+    throw new Error("Missing token. Run `canary login` first or set CANARY_API_TOKEN.");
+  }
+  return token;
+}
+function getSessionToolDefinitions() {
+  return [
+    {
+      name: "local_browser_start",
+      description: "Start a local browser session that connects to the cloud agent. The cloud agent can then control this browser to test local applications. Returns sessionId for tracking.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          mode: {
+            type: "string",
+            enum: ["playwright", "cdp"],
+            description: "Browser mode: 'playwright' for fresh browser, 'cdp' to connect to existing Chrome"
+          },
+          cdpUrl: {
+            type: "string",
+            description: "CDP endpoint URL when mode is 'cdp' (e.g. http://localhost:9222)"
+          },
+          headless: {
+            type: "boolean",
+            description: "Run browser headless (default: true for playwright mode)"
+          },
+          storageStatePath: {
+            type: "string",
+            description: "Path to Playwright storage state JSON for pre-authenticated sessions"
+          },
+          instructions: {
+            type: "string",
+            description: "Instructions for the cloud agent on what to test"
+          }
+        }
+      }
+    },
+    {
+      name: "local_browser_status",
+      description: "Check the status of a local browser session.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          sessionId: { type: "string" }
+        },
+        required: ["sessionId"]
+      }
+    },
+    {
+      name: "local_browser_stop",
+      description: "Stop a local browser session and close the browser.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          sessionId: { type: "string" }
+        },
+        required: ["sessionId"]
+      }
+    },
+    {
+      name: "local_browser_list",
+      description: "List all active local browser sessions.",
+      inputSchema: {
+        type: "object",
+        properties: {}
+      }
+    },
+    {
+      name: "local_browser_run",
+      description: "Start a test run on an active local browser session. The cloud agent will control the local browser according to the instructions.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          sessionId: {
+            type: "string",
+            description: "The session ID from local_browser_start"
+          },
+          instructions: {
+            type: "string",
+            description: "Instructions for the cloud agent on what to test"
+          },
+          startUrl: {
+            type: "string",
+            description: "Optional URL to navigate to before starting"
+          }
+        },
+        required: ["sessionId", "instructions"]
+      }
+    }
+  ];
+}
+async function handleSessionTool(tool, args) {
+  const token = await resolveToken();
+  if (tool === "local_browser_start") {
+    const input = args;
+    const apiUrl = resolveApiUrl2();
+    const mode = input.mode ?? "playwright";
+    const sessionResponse = await fetch(`${apiUrl}/local-browser/sessions`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify({
+        browserMode: mode,
+        instructions: input.instructions ?? null
+      })
+    });
+    if (!sessionResponse.ok) {
+      const text = await sessionResponse.text();
+      return toolJson2({ ok: false, error: `Failed to create session: ${text}` });
+    }
+    const session = await sessionResponse.json();
+    const host = new LocalBrowserHost({
+      apiUrl,
+      wsToken: session.wsToken,
+      sessionId: session.sessionId,
+      browserMode: mode,
+      cdpUrl: input.cdpUrl,
+      headless: input.headless ?? true,
+      storageStatePath: input.storageStatePath,
+      onLog: (level, message) => {
+        if (level === "error") {
+          console.error(`[LocalBrowser] ${message}`);
+        }
+      }
+    });
+    host.start().catch((err) => {
+      console.error("Failed to start local browser:", err);
+      browserSessions.delete(session.sessionId);
+    });
+    browserSessions.set(session.sessionId, {
+      sessionId: session.sessionId,
+      host,
+      startedAt: Date.now(),
+      mode
+    });
+    return toolJson2({
+      ok: true,
+      sessionId: session.sessionId,
+      mode,
+      expiresAt: session.expiresAt,
+      note: "Browser session started. The cloud agent can now control this browser. Use local_browser_stop to end the session."
+    });
+  }
+  if (tool === "local_browser_status") {
+    const input = args;
+    const session = browserSessions.get(input.sessionId);
+    if (!session) {
+      return toolJson2({ ok: false, error: "Session not found", sessionId: input.sessionId });
+    }
+    return toolJson2({
+      ok: true,
+      sessionId: session.sessionId,
+      mode: session.mode,
+      startedAt: new Date(session.startedAt).toISOString(),
+      uptimeMs: Date.now() - session.startedAt
+    });
+  }
+  if (tool === "local_browser_stop") {
+    const input = args;
+    const session = browserSessions.get(input.sessionId);
+    if (!session) {
+      return toolJson2({ ok: false, error: "Session not found", sessionId: input.sessionId });
+    }
+    await session.host.stop();
+    browserSessions.delete(input.sessionId);
+    return toolJson2({
+      ok: true,
+      sessionId: input.sessionId,
+      note: "Browser session stopped and browser closed."
+    });
+  }
+  if (tool === "local_browser_list") {
+    const sessions = Array.from(browserSessions.values()).map((s) => ({
+      sessionId: s.sessionId,
+      mode: s.mode,
+      startedAt: new Date(s.startedAt).toISOString(),
+      uptimeMs: Date.now() - s.startedAt
+    }));
+    return toolJson2({
+      ok: true,
+      count: sessions.length,
+      sessions
+    });
+  }
+  if (tool === "local_browser_run") {
+    const input = args;
+    const apiUrl = resolveApiUrl2();
+    const session = browserSessions.get(input.sessionId);
+    if (!session) {
+      return toolJson2({
+        ok: false,
+        error: "Session not found locally. Make sure you started it with local_browser_start.",
+        sessionId: input.sessionId
+      });
+    }
+    const response = await fetch(`${apiUrl}/local-browser/sessions/${input.sessionId}/run`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify({
+        instructions: input.instructions,
+        startUrl: input.startUrl ?? null
+      })
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      return toolJson2({ ok: false, error: `Failed to start run: ${text}` });
+    }
+    const result = await response.json();
+    return toolJson2({
+      ok: true,
+      jobId: result.jobId,
+      sessionId: result.sessionId,
+      note: "Test run started. The cloud agent is now controlling your local browser. You can watch the browser to see the test in action."
+    });
+  }
+  return null;
+}
+
+// src/mcp/browser-tools.ts
+var activeSessionId = null;
+function getBrowserMCPToolDefinitions() {
+  return getBrowserToolDefinitionsWithLifecycle();
+}
+async function handleBrowserTool(name, args) {
+  if (name === "browser_start") {
+    try {
+      const result = await createSession({
+        headless: args.headless ?? false,
+        storageStatePath: args.storageStatePath
+      });
+      if (!result.ok) {
+        return toolJson2({ ok: false, error: result.error });
+      }
+      activeSessionId = result.data.id;
+      return toolJson2({
+        ok: true,
+        sessionId: activeSessionId,
+        note: "Browser started. You can now use browser_navigate, browser_click, and other browser tools."
+      });
+    } catch (err) {
+      return toolJson2({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (name === "browser_stop") {
+    try {
+      if (activeSessionId) {
+        await deleteSession(activeSessionId);
+        activeSessionId = null;
+      } else {
+        await deleteAllSessions();
+      }
+      return toolJson2({ ok: true, note: "Browser stopped and cleaned up." });
+    } catch (err) {
+      return toolJson2({ ok: false, error: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  if (!name.startsWith("browser_")) return null;
+  try {
+    let sessionId = activeSessionId;
+    if (!sessionId) {
+      try {
+        const target = await resolveTargetSession();
+        sessionId = target.id;
+        activeSessionId = sessionId;
+      } catch {
+        return toolJson2({
+          ok: false,
+          error: "No active browser session. Start one with browser_start first."
+        });
+      }
+    }
+    const toolName = name.replace(/^browser_/, "");
+    const result = await callTool(sessionId, toolName, args);
+    if (!result.ok) {
+      if (result.error?.includes("not found")) {
+        activeSessionId = null;
+      }
+      if (result.errorCode === USER_PAUSED_ERROR) {
+        return toolText2(result.error ?? "User has taken control of the browser.");
+      }
+      return toolJson2({ ok: false, error: result.error, tool: name });
+    }
+    const toolResult = result.images?.length ? { text: result.text ?? "", images: result.images } : result.text ?? "";
+    return formatMCPContent(toolResult);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return toolJson2({ ok: false, error: message, tool: name });
+  }
+}
+
+// src/mcp/login-tool.ts
+function getLoginToolDefinitions() {
+  return [
+    {
+      name: "canary_login",
+      description: "Authenticate with Canary using the device code OAuth flow. Opens a browser window for the user to approve. May take 30-120 seconds while waiting for the user to complete login. Returns the verification URL and user code in case the browser does not open automatically.",
+      inputSchema: {
+        type: "object",
+        properties: {
+          env: {
+            type: "string",
+            enum: ["prod", "dev", "local"],
+            description: "Target environment (default: prod)"
+          },
+          org: {
+            type: "string",
+            description: "Organization name or ID to select if the user belongs to multiple orgs. If omitted, uses the default org."
+          }
+        }
+      }
+    }
+  ];
+}
+async function handleLoginTool(tool, args) {
+  if (tool !== "canary_login") return null;
+  try {
+    const env = args.env;
+    const orgFlag = args.org;
+    const envUrls = env ? ENV_URLS[env] : void 0;
+    if (env && !envUrls) {
+      return toolJson2({ ok: false, error: `Unknown environment: ${env}. Valid: prod, dev, local` });
+    }
+    const apiUrl = envUrls?.api ?? resolveApiUrl();
+    const appUrl = envUrls?.app ?? resolveAppUrl(apiUrl);
+    const startRes = await fetch(`${apiUrl}/cli-login/start`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ appUrl })
+    });
+    const startJson = await startRes.json();
+    if (!startRes.ok || !startJson.ok || !startJson.deviceCode || !startJson.userCode) {
+      return toolJson2({
+        ok: false,
+        error: `Login start failed: ${startJson.error ?? startRes.statusText}`
+      });
+    }
+    if (startJson.verificationUrl) {
+      try {
+        openUrl(startJson.verificationUrl);
+      } catch {
+      }
+    }
+    const intervalMs = (startJson.intervalSeconds ?? 3) * 1e3;
+    const expiresAt = startJson.expiresAt ? new Date(startJson.expiresAt).getTime() : null;
+    let token;
+    let initialOrgId;
+    while (true) {
+      if (expiresAt && Date.now() > expiresAt) {
+        return toolJson2({
+          ok: false,
+          error: "Login code expired. Please try again.",
+          userCode: startJson.userCode,
+          verificationUrl: startJson.verificationUrl
+        });
+      }
+      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+      const pollRes = await fetch(`${apiUrl}/cli-login/poll`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ deviceCode: startJson.deviceCode })
+      });
+      const pollJson = await pollRes.json();
+      if (!pollRes.ok || !pollJson.ok) {
+        return toolJson2({
+          ok: false,
+          error: `Login poll failed: ${pollJson.error ?? pollRes.statusText}`
+        });
+      }
+      if (pollJson.status === "approved" && pollJson.accessToken) {
+        token = pollJson.accessToken;
+        initialOrgId = pollJson.orgId;
+        break;
+      }
+      if (pollJson.status === "rejected") {
+        return toolJson2({ ok: false, error: "Login rejected by user." });
+      }
+      if (pollJson.status === "expired") {
+        return toolJson2({ ok: false, error: "Login expired. Please try again." });
+      }
+    }
+    const orgsData = await fetchOrgs(apiUrl, token);
+    const orgs = orgsData?.organizations ?? [];
+    let finalToken = token;
+    let finalOrgId = initialOrgId;
+    let finalOrgName;
+    if (orgs.length <= 1) {
+      finalOrgName = orgs[0]?.name;
+    } else if (orgFlag) {
+      const selectedOrg = orgs.find(
+        (o) => o.name.toLowerCase() === orgFlag.toLowerCase() || o.id === orgFlag
+      );
+      if (!selectedOrg) {
+        const profileName2 = env ? envToProfile(env) : void 0;
+        await saveAuth({ token: finalToken, apiUrl, orgId: finalOrgId, orgName: orgs.find((o) => o.id === initialOrgId)?.name }, profileName2);
+        return toolJson2({
+          ok: false,
+          error: `Organization "${orgFlag}" not found.`,
+          loggedIn: true,
+          currentOrg: orgs.find((o) => o.id === initialOrgId)?.name,
+          availableOrgs: orgs.map((o) => ({ id: o.id, name: o.name, role: o.role }))
+        });
+      }
+      if (selectedOrg.id !== initialOrgId) {
+        const switchRes = await switchOrg(apiUrl, token, selectedOrg.id);
+        if (!switchRes.ok || !switchRes.accessToken) {
+          return toolJson2({
+            ok: false,
+            error: `Failed to switch organization: ${switchRes.error ?? "Unknown error"}`
+          });
+        }
+        finalToken = switchRes.accessToken;
+        finalOrgId = switchRes.orgId;
+        finalOrgName = switchRes.orgName;
+      } else {
+        finalOrgName = selectedOrg.name;
+      }
+    } else {
+      const defaultOrg = orgs.find((o) => o.id === initialOrgId);
+      finalOrgName = defaultOrg?.name;
+    }
+    const profileName = env ? envToProfile(env) : void 0;
+    await saveAuth({ token: finalToken, apiUrl, orgId: finalOrgId, orgName: finalOrgName }, profileName);
+    return toolJson2({
+      ok: true,
+      message: "Login successful. Token saved.",
+      orgName: finalOrgName,
+      orgId: finalOrgId,
+      ...orgs.length > 1 ? { availableOrgs: orgs.map((o) => ({ id: o.id, name: o.name, role: o.role })) } : {}
+    });
+  } catch (err) {
+    return toolJson2({ ok: false, error: err instanceof Error ? err.message : String(err) });
+  }
+}
+
+// src/mcp/upgrade-tool.ts
+import fs from "fs";
+import { spawnSync } from "child_process";
+import process3 from "process";
+function detectPackageManager() {
+  try {
+    const binPath = fs.realpathSync(process3.argv[1]).replace(/\\/g, "/");
+    if (binPath.includes(".bun/") || binPath.includes("/bun/")) return "bun";
+    if (binPath.includes(".pnpm/") || binPath.includes("/pnpm/")) return "pnpm";
+  } catch {
+  }
+  return "npm";
+}
+var UPGRADE_COMMANDS = {
+  bun: ["bun", "add", "-g", `${packageName}@latest`],
+  pnpm: ["pnpm", "add", "-g", `${packageName}@latest`],
+  npm: ["npm", "install", "-g", `${packageName}@latest`]
+};
+function getUpgradeToolDefinitions() {
+  return [
+    {
+      name: "canary_upgrade",
+      description: "Upgrade the Canary CLI to the latest version. Detects the package manager (npm, bun, pnpm) and runs the appropriate global install command.",
+      inputSchema: {
+        type: "object",
+        properties: {}
+      }
+    }
+  ];
+}
+async function handleUpgradeTool(tool, _args) {
+  if (tool !== "canary_upgrade") return null;
+  try {
+    const pm = detectPackageManager();
+    const cmd = UPGRADE_COMMANDS[pm];
+    const result = spawnSync(cmd[0], cmd.slice(1), {
+      stdio: ["pipe", "pipe", "pipe"],
+      cwd: process3.cwd(),
+      timeout: 12e4,
+      shell: process3.platform === "win32",
+      windowsHide: true
+    });
+    if (result.error) {
+      return toolJson2({
+        ok: false,
+        error: `Failed to run ${pm}: ${result.error.message}`
+      });
+    }
+    const stdout = result.stdout?.toString().trim() ?? "";
+    const stderr = result.stderr?.toString().trim() ?? "";
+    if (result.status !== 0) {
+      return toolJson2({
+        ok: false,
+        error: `Upgrade failed (exit code ${result.status}).`,
+        output: stderr || stdout
+      });
+    }
+    await clearUpdateCache();
+    return toolJson2({
+      ok: true,
+      message: `Successfully upgraded ${packageName} to the latest version.`,
+      packageManager: pm,
+      output: stdout || void 0
+    });
+  } catch (err) {
+    return toolJson2({ ok: false, error: err instanceof Error ? err.message : String(err) });
+  }
+}
+
+// src/mcp/instructions.ts
+var CANARY_MCP_INSTRUCTIONS = `
+# Canary \u2014 AI-Powered QA Platform
+
+You have access to the Canary MCP tools for testing web applications, managing test workflows, and investigating issues. This guide teaches you how to use them effectively.
+
+## Authentication & Defaults
+
+- **Always use env: "prod"** when calling canary_login unless the user explicitly asks for dev or local.
+- After login, if multiple organizations are available, ask the user which one to use. Pass the org name via the \`org\` parameter.
+- To switch orgs later, call canary_login again with the \`org\` parameter \u2014 no need to re-authenticate.
+
+## Browser Sessions \u2014 Exploring Apps
+
+Use browser tools to interactively explore and test web applications. The workflow is:
+
+### Starting a Session
+
+1. **List credentials first:** Call \`canary_credential_list\` to see available credentials with their property names and base URLs.
+2. **Pick the right credential:**
+   - Prefer the **default credential** (\`isDefault: true\`)
+   - **Never** use a credential with "local" or "manual" in the name \u2014 these are for local development and won't work in deployed environments
+   - If multiple non-local credentials exist and you're unsure, ask the user
+3. **Start the browser with a credential:** Use \`browser_start\` to launch a headed browser, then load the credential's storage state. Or use the session tools (\`local_browser_start\`) for cloud-relay sessions.
+
+### The Core Interaction Loop
+
+**snapshot \u2192 read \u2192 act \u2192 snapshot \u2192 verify**
+
+This is the fundamental pattern. Never skip the verification snapshot.
+
+1. **Snapshot the page** with \`browser_snapshot\` to see what's on screen. The accessibility tree shows elements with refs like \`[ref=e15]\`.
+2. **Find elements efficiently** using the \`search\` parameter: \`browser_snapshot\` with \`search: "Submit"\` or \`search: "Email|Password"\` (OR-matched, case-insensitive).
+3. **Interact using refs** from the snapshot \u2014 click, type, fill, select. Always use refs, not coordinates. Fall back to coordinate-based clicking only when refs fail (overlays, canvas elements).
+4. **Snapshot again** after every action to verify it succeeded. Never assume an action worked.
+5. **Check for errors** after form submissions or navigation \u2014 look at the page content for error messages, and use console/network tools if available.
+
+### Tips
+
+- Use \`search\` to locate elements quickly rather than scanning the full accessibility tree.
+- Use \`browser_snapshot\` with \`mode: "screenshot"\` for visual verification when you need to see the actual rendering.
+- Wait for async operations (API calls, animations) before snapshotting \u2014 look for loading indicators.
+- Group related observations: take one snapshot and read the full tree rather than searching for every element individually.
+
+## Building Tests \u2014 Workflow Authoring
+
+After exploring an app via browser session, you can persist what you discovered as a reusable test workflow. The flow is: **explore \u2192 author \u2192 create**.
+
+### Step 1: Gather Credential Info
+
+Call \`canary_credential_list\` to get the credential UUID. You'll need it for the login node.
+- Always use \`credentialId\` (UUID) \u2014 never just the credential name
+- Set both \`credentialId\` and \`credentialName\` in the login node
+
+### Step 2: Design the Workflow
+
+A workflow is a directed graph of **nodes** connected by **edges**.
+
+#### Node Types
+
+| Type | Purpose | Required configJson |
+|------|---------|-------------------|
+| \`login\` | Authenticate with a credential | \`credentialId\`, \`credentialName\` |
+| \`navigate\` | Go to a URL | \`pageUrl\`, \`pageTitle\` |
+| \`action\` | Interact with elements | \`customActionTitle\`, \`playbookSteps\`, optionally \`inlineAssertions\` |
+| \`assertion\` | Standalone page verification | \`condition\` text |
+| \`end\` | Terminal node | (none) |
+
+#### Action Node Guidelines
+
+- Every action node **must** have a \`customActionTitle\` \u2014 a short (3-8 word) human-readable title describing the step (e.g., "Create a new invoice", "Fill registration form")
+- **Group related actions** into a single action node (one node per logical step, not per click)
+- **Prefer inline assertions** on action nodes over separate assertion nodes. Add \`inlineAssertions\` to verify outcomes right after the action. **Do not author an \`id\` field** \u2014 the server stamps a UUID on persist:
+  \`\`\`json
+  {
+    "inlineAssertions": [
+      {
+        "condition": "Success message 'Invoice created' is visible",
+        "severity": "fail"
+      }
+    ]
+  }
+  \`\`\`
+- Use separate \`assertion\` nodes only for standalone page-level verifications (e.g., initial page state before any action)
+
+#### Playbook Steps (inside action nodes)
+
+Playbook steps describe what to do within an action node. Each step has:
+- \`order\`: sequence number (1, 2, 3...)
+- \`action\`: what to do \u2014 \`click\`, \`fill\`, \`fill_form\`, \`select\`, \`navigate\`, \`wait\`, \`scroll\`, \`hover\`, \`upload\`, \`verify\`, \`press_key\`, \`drag\`, \`resize\`, \`capture\`, \`extract_table\`, \`python_execute\`, \`verify_download\`, \`verify_download_content\`, \`screenshot\`, \`agent_loop\`
+- \`target\`: **semantic description** from the accessibility tree \u2014 button text, field labels, placeholder text. Describe as a human would: "Submit button", "Email input field", "Status dropdown". **Never use refs, CSS selectors, or XPaths.**
+- \`params\`: for \`fill\` actions, include \`{ "value": "..." }\`
+
+Each playbook step maps to at most one recorded browser tool call. If the user intent took multiple clicks, fills, key presses, or assertions, write multiple playbook steps instead of bundling them. Do not use \`other\`; if no concrete browser-tool-backed action fits, omit that diagnostic observation from \`playbookSteps\`. Use \`click\` for switches, checkboxes, and click-to-focus behavior. Use \`press_key\` with \`{ "key": "Escape" }\` or an explicit \`click\` to close popovers and panels; there is no \`dismiss\`, \`toggle\`, \`focus\`, or \`handle_native_dialog\` action.
+
+### Macros \u2014 Always Prefer Over Hardcoded Data
+
+Macros generate fresh values each run, preventing flaky tests from stale or colliding data. **Never hardcode emails, names, phone numbers, or dates when a macro exists.**
+
+| Macro | Output | Example |
+|-------|--------|---------|
+| \`$EMAIL()\` | Unique test email | \`test-xk9mq2@example-test.com\` |
+| \`$FIRST_NAME()\` | Random first name | \`Jordan\` |
+| \`$LAST_NAME()\` | Random last name | \`Chen\` |
+| \`$PHONE()\` | US phone (555 prefix) | \`+1-555-382-7491\` |
+| \`$UUID()\` | Random UUID v4 | \`a1b2c3d4-...\` |
+| \`$RANDOM_INT(min, max)\` | Random integer | \`$RANDOM_INT(100,999)\` \u2192 \`427\` |
+| \`$RANDOM_STRING(length)\` | Alphanumeric string | \`$RANDOM_STRING(8)\` \u2192 \`xK9mQ3bR\` |
+| \`$TODAY()\` | Current date (YYYY-MM-DD) | \`2026-04-06\` |
+| \`$DATE(days)\` | Date offset from today | \`$DATE(-7)\` \u2192 last week |
+| \`$NOW()\` | ISO 8601 timestamp | \`2026-04-06T14:30:00.000Z\` |
+| \`$TIMESTAMP()\` | Unix milliseconds | \`1771520400000\` |
+| \`$SEQUENCE("name")\` | Auto-incrementing per run | \`1\`, \`2\`, \`3\`... |
+
+Macros combine inline: \`"QA Test $FIRST_NAME() $LAST_NAME()"\`, \`"order-$RANDOM_STRING(6)"\`
+
+**Prefix test data with "QA Test"** for identifiability.
+
+### Step 3: Create the Workflow
+
+Use \`canary_workflow_sync\` for existing workflows or construct the full workflow JSON and create via the API. Then verify with \`canary_workflow_get\`.
+
+### Example Workflow JSON
+
+\`\`\`json
+{
+  "name": "Verify user can create an invoice",
+  "description": "Tests the invoice creation flow end-to-end",
+  "nodes": [
+    {
+      "nodeType": "login",
+      "configJson": {
+        "credentialId": "4f6db838-16be-49e8-8887-8d0be1c83a87",
+        "credentialName": "QA User"
+      }
+    },
+    {
+      "nodeType": "navigate",
+      "configJson": { "pageUrl": "/invoices", "pageTitle": "Invoices" }
+    },
+    {
+      "nodeType": "action",
+      "configJson": {
+        "customActionTitle": "Create a new invoice",
+        "actionDescription": "Fill out the new invoice form and save",
+        "playbookSteps": [
+          { "order": 1, "action": "click", "target": "New Invoice button" },
+          { "order": 2, "action": "fill", "target": "Client name field", "params": { "value": "QA Test $FIRST_NAME()" } },
+          { "order": 3, "action": "fill", "target": "Amount field", "params": { "value": "$RANDOM_INT(100,999)" } },
+          { "order": 4, "action": "click", "target": "Save button" }
+        ],
+        "inlineAssertions": [
+          {
+            "condition": "Success message 'Invoice created' is visible and the new invoice appears in the list",
+            "severity": "fail"
+          }
+        ]
+      }
+    }
+  ]
+}
+\`\`\`
+
+## Managing Workflows
+
+- **canary_workflow_list** \u2014 Browse existing tests. Filter by \`status\` (draft = editable, published = active in regression runs), \`flowType\` (standard/setup/seed/teardown), or \`search\` by name. Reliability is tracked separately by the workflow's \`health\`.
+- **canary_workflow_get** \u2014 Inspect a test's full definition: nodes, edges, playbook steps, assertions.
+- **canary_workflow_patch** \u2014 Update name, description, status, or flow type. Only provided fields change.
+- **canary_workflow_run** \u2014 Trigger execution. Returns a \`runId\` \u2014 use it to track progress.
+- **canary_workflow_sync** \u2014 Atomically replace all nodes and edges. Automatically snapshots current state first so changes are reversible. Read the current DAG with \`canary_workflow_get\` before syncing.
+
+## Monitoring Runs & Debugging Failures
+
+After triggering a workflow run, monitor and debug with:
+
+- **canary_workflow_runs_list** \u2014 Recent runs for a workflow with status and duration.
+- **canary_workflow_runs_get** \u2014 Detailed run view: step-by-step status, duration, errors. Also works for in-progress runs to check status.
+- **canary_workflow_runs_diagnostics** \u2014 AI-generated failure analysis. Returns root cause and recommendations. Falls back to raw console logs and network requests if no AI analysis is available.
+
+### Regression Suite
+
+- **canary_test_suite_run** \u2014 Trigger a regression suite execution. Returns suiteId for tracking. Use canary_test_suite_list or canary_test_suite_get to check results.
+- **canary_test_suite_list** \u2014 Recent regression suite executions with pass/fail counts.
+- **canary_test_suite_get** \u2014 Individual test results within a suite execution.
+- **canary_test_suite_diagnostics** \u2014 Failure diagnostics for a specific test in a suite run.
+- **canary_test_suite_steps** \u2014 Step-by-step breakdown of a test run within a suite.
+
+## Investigating Issues
+
+Issues are bugs discovered by Canary during test runs.
+
+- **canary_issues_list** \u2014 Search and filter issues by severity (\`low\`/\`medium\`/\`high\`), status (\`open\`/\`closed\`/\`not_a_bug\`), or property. Supports full-text search.
+- **canary_issues_get** \u2014 Full issue detail including console errors and network failures from the latest occurrence. Use this to understand what went wrong.
+
+## API Sequences (API-only workflows)
+
+For APIs that need deterministic, browser-free smoke testing \u2014 composed of ordered HTTP calls that chain outputs into inputs.
+
+- **Create** with the same command as any workflow, with \`--api-only\`:
+  \`canary workflow create --api-only --name "<n>" --sequence-from-file seq.json\`
+  Returns \`{ workflowId, apiSequenceId, nodeId }\`. No \`--property\` \u2014 api-sequences are org-scoped.
+- **Inspect runs** with the same command as any runs, with \`--side api\` (or \`--side all\` for both):
+  \`canary workflow runs list <wf> --side api\`
+  \`canary workflow runs get <wf> <runId>\`
+- **Edit the sequence itself** via \`canary workflow api-sequence <verb>\`:
+  - \`get <wf>\` \u2014 dump config + steps
+  - \`update <wf> --from-file seq.json\` \u2014 replace config
+  - \`execute <wf>\` \u2014 run it
+  - \`generate <wf> [--prompt "..."]\` \u2014 AI-draft a config, then refine with \`update\`
+- **Discover endpoints** before composing steps:
+  \`canary api-catalog sources list\`
+  \`canary api-catalog endpoints list --search <q>\`
+  \`canary api-catalog endpoints create --from-file ep.json\` (add a one-off)
+- **Read the reference first** for the config/step shape and template syntax:
+  \`canary workflow guide api-sequences\`
+
+Templates in step fields use \`{{stepId.response.path}}\` to reference prior-step outputs and \`$MACRO()\` for dynamic test data (same macros as browser workflows).
+
+## Common Workflows
+
+### "Let's explore the app"
+1. \`canary_login\` (env: prod) \u2192 switch to the right org
+2. \`canary_credential_list\` \u2192 find the right credential
+3. \`browser_start\` \u2192 launch browser
+4. Load credential and navigate to the app
+5. Snapshot, interact, explore
+
+### "Write a test for this feature"
+1. Explore the feature via browser (above workflow)
+2. \`canary_credential_list\` \u2192 get credentialId
+3. Construct workflow JSON with nodes, edges, playbook steps, macros
+4. Create or sync the workflow
+5. \`canary_workflow_run\` \u2192 execute it
+6. \`canary_workflow_runs_get\` \u2192 verify it passes
+
+### "Why did this test fail?"
+1. \`canary_workflow_runs_list\` \u2192 find the failed run
+2. \`canary_workflow_runs_get\` \u2192 see which step failed
+3. \`canary_workflow_runs_diagnostics\` \u2192 AI analysis of the failure
+4. If needed, open a browser session to reproduce and investigate
+
+### "What issues have been found?"
+1. \`canary_issues_list\` \u2192 browse open issues
+2. \`canary_issues_get\` \u2192 deep dive with console/network errors
+`.trim();
+
+// src/mcp/index.ts
+async function resolveCtx() {
+  const apiToken = process4.env.CANARY_API_TOKEN ?? await readStoredToken();
+  if (!apiToken) {
+    throw new Error("Missing token. Call the canary_login tool or set CANARY_API_TOKEN.");
+  }
+  return { apiUrl: resolveApiUrl(), apiToken };
+}
+async function runMcp(_argv) {
+  const registry = buildRegistry(sharedGroups);
+  const server = new Server(
+    { name: "canary-cli", version: "0.1.0" },
+    {
+      capabilities: { tools: {} },
+      instructions: CANARY_MCP_INSTRUCTIONS
+    }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: [
+      ...getLoginToolDefinitions(),
+      ...getUpgradeToolDefinitions(),
+      ...getSessionToolDefinitions(),
+      ...getBrowserMCPToolDefinitions(),
+      ...registry.list()
+    ]
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const tool = req.params.name;
+    const args = req.params.arguments ?? {};
+    const loginResult = await handleLoginTool(tool, args);
+    if (loginResult) return loginResult;
+    const upgradeResult = await handleUpgradeTool(tool, args);
+    if (upgradeResult) return upgradeResult;
+    const browserResult = await handleBrowserTool(tool, args);
+    if (browserResult) return browserResult;
+    const sessionResult = await handleSessionTool(tool, args);
+    if (sessionResult) return sessionResult;
+    try {
+      const ctx = await resolveCtx();
+      return await registry.call(tool, args, ctx);
+    } catch (err) {
+      return toolText2(err instanceof Error ? err.message : String(err));
+    }
+  });
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  return new Promise(() => void 0);
+}
+export {
+  runMcp
+};
+//# sourceMappingURL=mcp-54IJEOUA.js.map