@sideboard-ai/core 0.1.302 → 0.1.304

package/dist/{chunk-2KJE53ZJ.js → chunk-G2L3CR3A.js}

@@ -3,7 +3,7 @@ import {
   brightsyMcpServerName,
   ensureCliTeamTracked,
   ensureConnectedBrightsyTeamTokens
-} from "./chunk-VGNLMGBK.js";
+} from "./chunk-VEVFHO6K.js";
 import {
   looksLikeConversationSummary,
   looksLikeSkillBody,
@@ -12,13 +12,13 @@ import {
 } from "./chunk-F36QRDM4.js";
 import {
   isOrchestratorThread
-} from "./chunk-7SEWZXPT.js";
+} from "./chunk-5QX2NYXL.js";
 import {
   codexUnattendedGitConfigArgs,
   mergeAgentGitAuthEnv,
   resolveAgentGitAuthEnv,
   resolveCodexGitWritableRoots
-} from "./chunk-KIWICTLW.js";
+} from "./chunk-BIPXOHZI.js";
 import {
   loadBrightsyConfig
 } from "./chunk-33KDPEK4.js";
@@ -31,7 +31,7 @@ import {
   CLAUDE_POSTHOG_CONNECTOR_ALLOWED_TOOLS,
   CLAUDE_PRINT_BG_WAIT_CEILING_MS,
   mcpAllowToolsFromNames
-} from "./chunk-FO3NKZVJ.js";
+} from "./chunk-F2PVRF3B.js";
 import {
   CURSOR_SDK_INSTALL_HINT,
   applyAgentRunnerHeapEnv,
@@ -45,7 +45,7 @@ import {
   packagedMcpStdioPath,
   parseCursorRunnerLine,
   resolveNodeLaunch
-} from "./chunk-IOY2LF3Y.js";
+} from "./chunk-MMVMQ34G.js";
 import {
   extractJsonErrorMessage,
   formatUnknownDetail,
@@ -65,7 +65,7 @@ import {
   PILOT_TOOL_DESCRIPTIONS,
   PILOT_TOOL_NAMES,
   agentRpcConnectFromMetadata
-} from "./chunk-QDA6NXRA.js";
+} from "./chunk-YDUHLWI5.js";
 import {
   claudeChromeEnabled,
   fromInclusiveInputUsage,
@@ -75,14 +75,14 @@ import {
   loadAppSettings,
   resolveAgentExecutable,
   resolveClaudeExecutable
-} from "./chunk-RSATPXU4.js";
+} from "./chunk-A2YXQC65.js";
 import {
   isElectronLikeCommand,
   unwrapStrippedElectronLaunch
 } from "./chunk-4TR3HZFT.js";
 import {
   appDataDir
-} from "./chunk-EHT2DRT4.js";
+} from "./chunk-H4UEFJRI.js";
 
 // src/agents/brightsy.ts
 import { existsSync } from "fs";
@@ -512,24 +512,376 @@ var brightsyAdapter = {
 };
 
 // src/agents/claude.ts
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync7 } from "fs";
+import { homedir as homedir4 } from "os";
 
 // src/agents/orch-mcp-isolation.ts
-import { existsSync as existsSync4, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join3 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+
+// src/agents/claude-plugins.ts
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { homedir } from "os";
+import { isAbsolute, join, relative, resolve } from "path";
+
+// src/mcp-ui/meta.ts
+var HTML_MAX = 15e5;
+function matchClaudeMcpTool(toolName, serverNames) {
+  const name = toolName.trim();
+  if (!name.startsWith("mcp__")) return null;
+  const ranked = [...serverNames].filter((s) => s.trim()).sort((a, b) => b.length - a.length);
+  for (const server of ranked) {
+    const prefix = `mcp__${server}__`;
+    if (!name.startsWith(prefix)) continue;
+    const tool = name.slice(prefix.length).trim();
+    if (!tool) continue;
+    return { server, tool };
+  }
+  return null;
+}
+function parseMcpServerLaunch(entry) {
+  const command = typeof entry.command === "string" ? entry.command.trim() : "";
+  if (command) {
+    const args = Array.isArray(entry.args) ? entry.args.filter((a) => typeof a === "string") : [];
+    const env = stringRecord(entry.env);
+    const cwd = typeof entry.cwd === "string" && entry.cwd.trim() ? entry.cwd.trim() : void 0;
+    return {
+      kind: "stdio",
+      command,
+      args,
+      ...env ? { env } : {},
+      ...cwd ? { cwd } : {}
+    };
+  }
+  const url = typeof entry.url === "string" ? entry.url.trim() : "";
+  if (!url) return null;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+  const type = typeof entry.type === "string" ? entry.type.trim().toLowerCase() : "";
+  const headers = stringRecord(entry.headers);
+  return {
+    kind: type === "sse" ? "sse" : "http",
+    url: parsed.toString(),
+    ...headers ? { headers } : {}
+  };
+}
+function uiResourceUriFromMeta(meta) {
+  const rec = asRecord(meta);
+  const nested = asRecord(rec.ui);
+  const fromNested = typeof nested.resourceUri === "string" ? nested.resourceUri.trim() : "";
+  const legacy = typeof rec["ui/resourceUri"] === "string" ? rec["ui/resourceUri"].trim() : "";
+  const uri = fromNested || legacy;
+  return uri.startsWith("ui://") ? uri : null;
+}
+function cspFromMeta(meta) {
+  const ui = asRecord(asRecord(meta).ui);
+  const csp = asRecord(ui.csp);
+  const connectDomains = originList(csp.connectDomains);
+  const resourceDomains = originList(csp.resourceDomains);
+  const frameDomains = originList(csp.frameDomains);
+  const baseUriDomains = originList(csp.baseUriDomains);
+  if (!connectDomains?.length && !resourceDomains?.length && !frameDomains?.length && !baseUriDomains?.length) {
+    return void 0;
+  }
+  return {
+    ...connectDomains?.length ? { connectDomains } : {},
+    ...resourceDomains?.length ? { resourceDomains } : {},
+    ...frameDomains?.length ? { frameDomains } : {},
+    ...baseUriDomains?.length ? { baseUriDomains } : {}
+  };
+}
+function htmlFromResourceContent(content) {
+  const uri = content.uri?.trim() ?? "";
+  if (!uri.startsWith("ui://")) return null;
+  const mimeType = content.mimeType?.trim() || "text/html";
+  if (!isHtmlMime(mimeType)) return null;
+  const html = htmlText(content.text, content.blob);
+  if (!html) return null;
+  return { uri, mimeType, html };
+}
+function mcpUiContentSecurityPolicy(csp) {
+  const resource = (csp?.resourceDomains ?? []).join(" ");
+  const connect = (csp?.connectDomains ?? []).join(" ");
+  const frames = csp?.frameDomains?.length ? csp.frameDomains.join(" ") : "'none'";
+  const base = csp?.baseUriDomains?.length ? csp.baseUriDomains.join(" ") : "'none'";
+  return [
+    "default-src 'none'",
+    `script-src 'self' 'unsafe-inline' 'unsafe-eval' ${resource}`.trim(),
+    `style-src 'self' 'unsafe-inline' ${resource}`.trim(),
+    `img-src 'self' data: blob: ${resource}`.trim(),
+    `font-src 'self' data: ${resource}`.trim(),
+    `connect-src 'self' ${connect}`.trim(),
+    `media-src 'self' data: blob: ${resource}`.trim(),
+    `frame-src ${frames}`,
+    `base-uri ${base}`,
+    "object-src 'none'",
+    "form-action 'self'"
+  ].join("; ");
+}
+function htmlText(text, blob) {
+  if (typeof text === "string" && text.trim()) {
+    return text.length <= HTML_MAX ? text : null;
+  }
+  if (typeof blob !== "string" || !blob.trim()) return null;
+  try {
+    const decoded = decodeBase64(blob.trim());
+    if (!decoded.trim() || decoded.length > HTML_MAX) return null;
+    return decoded;
+  } catch {
+    return null;
+  }
+}
+function decodeBase64(blob) {
+  if (typeof Buffer !== "undefined") return Buffer.from(blob, "base64").toString("utf8");
+  const bin = atob(blob);
+  const bytes = Uint8Array.from(bin, (c) => c.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}
+function isHtmlMime(mime) {
+  const base = mime.split(";")[0]?.trim().toLowerCase() ?? "";
+  return base === "text/html";
+}
+function originList(value) {
+  if (!Array.isArray(value)) return void 0;
+  const out = [];
+  for (const item of value) {
+    if (typeof item !== "string") continue;
+    const origin = originToken(item);
+    if (origin && !out.includes(origin)) out.push(origin);
+  }
+  return out;
+}
+function originToken(value) {
+  try {
+    const url = new URL(value.trim());
+    if (url.protocol !== "https:" && url.protocol !== "http:" && url.protocol !== "wss:" && url.protocol !== "ws:") {
+      return null;
+    }
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+function stringRecord(value) {
+  const rec = asRecord(value);
+  const out = {};
+  for (const [key, item] of Object.entries(rec)) {
+    if (typeof item === "string") out[key] = item;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function asRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  return value;
+}
+
+// src/agents/claude-plugins.ts
+function claudePluginServerId(pluginName, serverName) {
+  return `plugin_${pluginName}_${serverName}`.replace(/[^A-Za-z0-9_-]/g, "_");
+}
+function listEnabledClaudePluginMcpServers(opts) {
+  const home = opts?.home ?? homedir();
+  const pluginsRoot = claudePluginsRoot(home);
+  const enabled = enabledPluginIds(home, opts?.projectDirs ?? []);
+  const installed = readInstalledPlugins(join(pluginsRoot, "installed_plugins.json"));
+  const out = {};
+  for (const [id, on] of enabled) {
+    if (!on) continue;
+    const root = installPathFor(id, installed);
+    if (!root || !existsSync2(root)) continue;
+    const pluginName = manifestName(root) || id.split("@")[0]?.trim() || "";
+    if (!pluginName) continue;
+    const dataDir = join(pluginsRoot, "data", pluginDataId(id));
+    for (const [serverName, entry] of Object.entries(loadPluginMcpServers(root))) {
+      const expanded = expandPluginEntry(entry, root, dataDir);
+      if (!parseMcpServerLaunch(expanded)) continue;
+      const key = claudePluginServerId(pluginName, serverName);
+      if (!key || key === "plugin__") continue;
+      out[key] = expanded;
+    }
+  }
+  return out;
+}
+function claudePluginsRoot(home) {
+  const override = process.env.CLAUDE_CODE_PLUGIN_CACHE_DIR?.trim();
+  if (override && isAbsolute(override)) return override;
+  return join(home, ".claude", "plugins");
+}
+function pluginDataId(pluginId) {
+  return pluginId.replace(/[^A-Za-z0-9_-]/g, "-");
+}
+function enabledPluginIds(home, projectDirs) {
+  const enabled = /* @__PURE__ */ new Map();
+  applyEnabled(enabled, readEnabledPlugins(join(home, ".claude", "settings.json")));
+  const dirs = [...new Set(projectDirs.map((dir) => dir.trim()).filter(Boolean))];
+  for (const dir of dirs) {
+    applyEnabled(enabled, readEnabledPlugins(join(dir, ".claude", "settings.json")));
+  }
+  for (const dir of dirs) {
+    applyEnabled(enabled, readEnabledPlugins(join(dir, ".claude", "settings.local.json")));
+  }
+  return enabled;
+}
+function applyEnabled(into, next) {
+  for (const [id, on] of Object.entries(next)) {
+    const key = id.trim();
+    if (!key) continue;
+    into.set(key, on);
+  }
+}
+function readEnabledPlugins(path) {
+  const root = readJson(path);
+  const raw = root.enabledPlugins;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const out = {};
+  for (const [id, value] of Object.entries(raw)) {
+    if (value === true || value === false) out[id] = value;
+  }
+  return out;
+}
+function readInstalledPlugins(path) {
+  const root = readJson(path);
+  const plugins = root.plugins;
+  if (!plugins || typeof plugins !== "object" || Array.isArray(plugins)) return {};
+  const out = {};
+  for (const [id, value] of Object.entries(plugins)) {
+    const rows = Array.isArray(value) ? value : [value];
+    const installs = [];
+    for (const row of rows) {
+      if (!row || typeof row !== "object" || Array.isArray(row)) continue;
+      const installPath = row.installPath;
+      installs.push({
+        ...typeof installPath === "string" && installPath.trim() ? { installPath: installPath.trim() } : {}
+      });
+    }
+    if (installs.length) out[id] = installs;
+  }
+  return out;
+}
+function installPathFor(id, installed) {
+  const rows = installed[id] ?? [];
+  for (let i = rows.length - 1; i >= 0; i--) {
+    const path = rows[i]?.installPath;
+    if (path && existsSync2(path)) return path;
+  }
+  return null;
+}
+function manifestName(root) {
+  const manifest = readJson(join(root, ".claude-plugin", "plugin.json"));
+  return typeof manifest.name === "string" ? manifest.name.trim() : "";
+}
+function loadPluginMcpServers(root) {
+  const servers = {};
+  mergeServerMap(servers, serversFromFile(join(root, ".mcp.json"), root));
+  const manifest = readJson(join(root, ".claude-plugin", "plugin.json"));
+  mergeServerMap(servers, serversFromManifest(manifest.mcpServers, root));
+  return servers;
+}
+function serversFromManifest(value, root) {
+  if (!value) return {};
+  if (typeof value === "string") return serversFromFile(resolveInside(root, value), root);
+  if (Array.isArray(value)) {
+    const out = {};
+    for (const item of value) {
+      if (typeof item === "string") mergeServerMap(out, serversFromFile(resolveInside(root, item), root));
+      else mergeServerMap(out, serverMap(item, root));
+    }
+    return out;
+  }
+  return serverMap(value, root);
+}
+function serversFromFile(path, root) {
+  if (!path || !existsSync2(path)) return {};
+  return serverMap(readJson(path), root);
+}
+function serverMap(value, root) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const record = value;
+  const wrapped = record.mcpServers;
+  const source = wrapped && typeof wrapped === "object" && !Array.isArray(wrapped) ? wrapped : record;
+  if (typeof wrapped === "string") return serversFromFile(resolveInside(root, wrapped), root);
+  const out = {};
+  for (const [name, entry] of Object.entries(source)) {
+    if (!name.trim() || !entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const row = entry;
+    if (row.disabled === true) continue;
+    if (typeof row.command !== "string" && typeof row.url !== "string") continue;
+    out[name.trim()] = row;
+  }
+  return out;
+}
+function mergeServerMap(into, extra) {
+  for (const [name, entry] of Object.entries(extra)) into[name] = entry;
+}
+function expandPluginEntry(entry, root, dataDir) {
+  const next = { ...entry };
+  if (typeof next.command === "string") next.command = expandVars(next.command, root, dataDir);
+  if (Array.isArray(next.args)) {
+    next.args = next.args.map((arg) => typeof arg === "string" ? expandVars(arg, root, dataDir) : arg);
+  }
+  if (typeof next.url === "string") next.url = expandVars(next.url, root, dataDir);
+  if (next.env && typeof next.env === "object" && !Array.isArray(next.env)) {
+    const env = {};
+    for (const [key, value] of Object.entries(next.env)) {
+      if (typeof value === "string") env[key] = expandVars(value, root, dataDir);
+    }
+    env.CLAUDE_PLUGIN_ROOT = env.CLAUDE_PLUGIN_ROOT || root;
+    env.CLAUDE_PLUGIN_DATA = env.CLAUDE_PLUGIN_DATA || dataDir;
+    next.env = env;
+  } else if (typeof next.command === "string") {
+    next.env = { CLAUDE_PLUGIN_ROOT: root, CLAUDE_PLUGIN_DATA: dataDir };
+  }
+  if (next.headers && typeof next.headers === "object" && !Array.isArray(next.headers)) {
+    const headers = {};
+    for (const [key, value] of Object.entries(next.headers)) {
+      if (typeof value === "string") headers[key] = expandVars(value, root, dataDir);
+    }
+    next.headers = headers;
+  }
+  return next;
+}
+function expandVars(value, root, dataDir) {
+  return value.replaceAll("${CLAUDE_PLUGIN_ROOT}", root).replaceAll("${CLAUDE_PLUGIN_DATA}", dataDir);
+}
+function resolveInside(root, spec) {
+  const trimmed = spec.trim();
+  if (!trimmed || trimmed.endsWith(".mcpb") || trimmed.endsWith(".dxt")) return null;
+  if (/^https?:\/\//i.test(trimmed)) return null;
+  const abs = resolve(root, trimmed);
+  const rel = relative(root, abs);
+  if (!rel || rel.startsWith("..") || isAbsolute(rel)) return null;
+  return abs;
+}
+function readJson(path) {
+  if (!existsSync2(path)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    return parsed;
+  } catch {
+    return {};
+  }
+}
+
+// src/agents/orch-mcp-isolation.ts
+import { homedir as homedir3 } from "os";
+import { join as join4 } from "path";
 import { parse as parseToml } from "smol-toml";
 
 // src/agents/user-mcp-config.ts
-import { existsSync as existsSync3, mkdirSync, readFileSync, writeFileSync as writeFileSync2 } from "fs";
-import { homedir } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname2, join as join3 } from "path";
 
 // src/agents/injected-mcp.ts
-import { existsSync as existsSync2, mkdtempSync, writeFileSync } from "fs";
+import { existsSync as existsSync3, mkdtempSync, writeFileSync } from "fs";
 import { createRequire } from "module";
 import { tmpdir } from "os";
-import { dirname, join } from "path";
+import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/mcp/profile.ts
@@ -763,7 +1115,7 @@ function corePackageDir() {
   } catch {
   }
   try {
-    const req = createRequire(join(process.cwd(), "package.json"));
+    const req = createRequire(join2(process.cwd(), "package.json"));
     return dirname(req.resolve("@sideboard-ai/core"));
   } catch {
     return process.cwd();
@@ -771,22 +1123,22 @@ function corePackageDir() {
 }
 function findSideboardMcpJsEntry() {
   const override = process.env.SIDEBOARD_MCP_ENTRY?.trim() || process.env.SIDEBOARD_CLI?.trim();
-  if (override && existsSync2(override)) return override;
+  if (override && existsSync3(override)) return override;
   const packaged = packagedMcpStdioPath();
   if (packaged) return packaged;
   let dir = corePackageDir();
   for (let i = 0; i < 10; i++) {
     const candidates = [
-      join(dir, "mcp/run-stdio.js"),
-      join(dir, "mcp/run-stdio.cjs"),
-      join(dir, "dist/mcp/run-stdio.js"),
-      join(dir, "dist/mcp/run-stdio.cjs"),
-      join(dir, "packages/core/dist/mcp/run-stdio.js"),
-      join(dir, "packages/cli/dist/index.js"),
-      join(dir, "cli/dist/index.js")
+      join2(dir, "mcp/run-stdio.js"),
+      join2(dir, "mcp/run-stdio.cjs"),
+      join2(dir, "dist/mcp/run-stdio.js"),
+      join2(dir, "dist/mcp/run-stdio.cjs"),
+      join2(dir, "packages/core/dist/mcp/run-stdio.js"),
+      join2(dir, "packages/cli/dist/index.js"),
+      join2(dir, "cli/dist/index.js")
     ];
     for (const p of candidates) {
-      if (existsSync2(p) && !isAsarPath(p)) return p;
+      if (existsSync3(p) && !isAsarPath(p)) return p;
     }
     const parent = dirname(dir);
     if (parent === dir) break;
@@ -949,8 +1301,8 @@ function mcpServersRecord(servers, extraServers) {
 function writeMcpServersConfig(servers, extraServers) {
   const mcpServers = mcpServersRecord(servers, extraServers);
   if (Object.keys(mcpServers).length === 0) return null;
-  const dir = mkdtempSync(join(tmpdir(), "sideboard-mcp-"));
-  const cfgPath = join(dir, "mcp.json");
+  const dir = mkdtempSync(join2(tmpdir(), "sideboard-mcp-"));
+  const cfgPath = join2(dir, "mcp.json");
   writeFileSync(cfgPath, JSON.stringify({ mcpServers }, null, 2));
   return cfgPath;
 }
@@ -960,10 +1312,10 @@ async function writeInjectedMcpConfig(opts) {
 
 // src/agents/user-mcp-config.ts
 function userCursorMcpConfigPath() {
-  return join2(homedir(), ".cursor", "mcp.json");
+  return join3(homedir2(), ".cursor", "mcp.json");
 }
 function userClaudeMcpConfigPath() {
-  return join2(homedir(), ".claude.json");
+  return join3(homedir2(), ".claude.json");
 }
 function asObject(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return {};
@@ -990,9 +1342,9 @@ function mergeSideboardIntoMcpServersJson(existing, sideboard) {
 }
 function writeMergedMcpServersJson(configPath, sideboard) {
   let existing = {};
-  if (existsSync3(configPath)) {
+  if (existsSync4(configPath)) {
     try {
-      existing = JSON.parse(readFileSync(configPath, "utf8"));
+      existing = JSON.parse(readFileSync2(configPath, "utf8"));
     } catch {
       existing = {};
     }
@@ -1017,7 +1369,7 @@ async function registerPackagedUserMcpClients() {
   const cursor = userCursorMcpConfigPath();
   writeMergedMcpServersJson(cursor, launch);
   const claude = userClaudeMcpConfigPath();
-  if (existsSync3(claude)) {
+  if (existsSync4(claude)) {
     writeMergedMcpServersJson(claude, launch);
     return { cursor, claude };
   }
@@ -1046,25 +1398,25 @@ function listMcpNamesFromCodexToml(text) {
 }
 function readJsonObject(path) {
   try {
-    return JSON.parse(readFileSync2(path, "utf8"));
+    return JSON.parse(readFileSync3(path, "utf8"));
   } catch {
     return {};
   }
 }
 function readText(path) {
   try {
-    return readFileSync2(path, "utf8");
+    return readFileSync3(path, "utf8");
   } catch {
     return "";
   }
 }
-function userCodexConfigPaths(home = homedir2()) {
-  return [join3(home, ".codex", "config.toml"), join3(home, ".config", "codex", "config.toml")];
+function userCodexConfigPaths(home = homedir3()) {
+  return [join4(home, ".codex", "config.toml"), join4(home, ".config", "codex", "config.toml")];
 }
-function userOpencodeConfigPaths(home = homedir2()) {
+function userOpencodeConfigPaths(home = homedir3()) {
   return [
-    join3(home, ".config", "opencode", "opencode.json"),
-    join3(home, ".config", "opencode", "opencode.jsonc")
+    join4(home, ".config", "opencode", "opencode.json"),
+    join4(home, ".config", "opencode", "opencode.jsonc")
   ];
 }
 function userMcpNamesToDisable(opts) {
@@ -1083,29 +1435,35 @@ function userMcpNamesToDisable(opts) {
   }
   return out;
 }
-function listUserCodexMcpNames(home = homedir2()) {
+function listUserCodexMcpNames(home = homedir3()) {
   const names = [];
   for (const path of userCodexConfigPaths(home)) {
-    if (!existsSync4(path)) continue;
+    if (!existsSync5(path)) continue;
     names.push(...listMcpNamesFromCodexToml(readText(path)));
   }
   return names;
 }
-function listUserOpencodeMcpNames(home = homedir2()) {
+function listUserOpencodeMcpNames(home = homedir3()) {
   const names = [];
   for (const path of userOpencodeConfigPaths(home)) {
-    if (!existsSync4(path)) continue;
+    if (!existsSync5(path)) continue;
     names.push(...listMcpNamesFromJsonMap(readJsonObject(path), "mcp"));
   }
   return names;
 }
-function userClaudeMcpConfigObject(home = homedir2()) {
-  const claudePath = home === homedir2() ? userClaudeMcpConfigPath() : join3(home, ".claude.json");
-  if (!existsSync4(claudePath)) return {};
+function userClaudeMcpConfigObject(home = homedir3()) {
+  const claudePath = home === homedir3() ? userClaudeMcpConfigPath() : join4(home, ".claude.json");
+  if (!existsSync5(claudePath)) return {};
   return asObject2(asObject2(readJsonObject(claudePath)).mcpServers);
 }
-function listUserClaudeMcpServerEntries(home = homedir2()) {
+function listUserClaudeMcpServerEntries(home = homedir3(), projectDirs) {
   const out = {};
+  for (const [name, entry] of Object.entries(
+    listEnabledClaudePluginMcpServers({ home, projectDirs })
+  )) {
+    if (!name || isInjectedOrchMcpName(name)) continue;
+    out[name] = entry;
+  }
   for (const [rawName, value] of Object.entries(userClaudeMcpConfigObject(home))) {
     const name = rawName.trim();
     if (!name || isInjectedOrchMcpName(name)) continue;
@@ -1194,9 +1552,9 @@ function agentRpcChildEnv(rpc, cwd) {
 }
 
 // src/agents/claude-host.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { createRequire as createRequire2 } from "module";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function claudePilotSdkAllowedTools() {
   return PILOT_TOOL_NAMES.map(
@@ -1224,20 +1582,20 @@ function entryDir() {
 function claudeRunnerPath() {
   const packagedDir = packagedCursorRuntimeDir();
   if (packagedDir) {
-    const packaged = join4(packagedDir, "core-dist", "agents", "claude-runner.js");
-    if (existsSync5(packaged)) return packaged;
+    const packaged = join5(packagedDir, "core-dist", "agents", "claude-runner.js");
+    if (existsSync6(packaged)) return packaged;
   }
   const root = entryDir();
   const candidates = [
-    join4(root, "agents", "claude-runner.js"),
-    join4(root, "agents", "claude-runner.cjs"),
-    join4(root, "dist", "agents", "claude-runner.js"),
-    join4(root, "dist", "agents", "claude-runner.cjs"),
-    join4(root, "claude-runner.ts"),
-    join4(root, "src", "agents", "claude-runner.ts")
+    join5(root, "agents", "claude-runner.js"),
+    join5(root, "agents", "claude-runner.cjs"),
+    join5(root, "dist", "agents", "claude-runner.js"),
+    join5(root, "dist", "agents", "claude-runner.cjs"),
+    join5(root, "claude-runner.ts"),
+    join5(root, "src", "agents", "claude-runner.ts")
   ];
   for (const candidate of candidates) {
-    if (existsSync5(candidate)) return candidate;
+    if (existsSync6(candidate)) return candidate;
   }
   return candidates[0];
 }
@@ -1642,7 +2000,7 @@ var claudeAdapter = {
   async detect() {
     const claude = resolveClaudeExecutable();
     if (claude !== "claude") {
-      if (!existsSync6(claude)) {
+      if (!existsSync7(claude)) {
         return {
           agent: "claude",
           installed: false,
@@ -1691,7 +2049,7 @@ var claudeAdapter = {
       );
     }
     const mode = permissionMode(thread);
-    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-V6SOEETA.js");
+    const { isOrchestratorThread: isOrchestratorThread2 } = await import("./global-workspace-BZAVBOH3.js");
     const isOrchestrator = isOrchestratorThread2(thread);
     const rpc = worktreeAgentRpc(isOrchestrator);
     const injectedServers = await buildInjectedMcpServers({
@@ -1705,7 +2063,7 @@ var claudeAdapter = {
     });
     const injectedBrightsyNames = injectedServers.filter((s) => s.name === "brightsy" || s.name.startsWith("brightsy_")).map((s) => s.name);
     const chromeOn = claudeChromeEnabled();
-    const userMcpEntries = isOrchestrator ? {} : listUserClaudeMcpServerEntries();
+    const userMcpEntries = isOrchestrator ? {} : listUserClaudeMcpServerEntries(homedir4(), [thread.repoPath, thread.worktreePath]);
     let allowedTools;
     if (isOrchestrator) {
       allowedTools = [
@@ -1956,9 +2314,9 @@ function parseIssuesJson(raw) {
 }
 
 // src/agents/codex.ts
-import { existsSync as existsSync7, readFileSync as readFileSync3, statSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join5 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync4, statSync } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
 var CODEX_PROMPT_ARG_MAX = 2e5;
 var FALLBACK_CODEX_MODELS = [
   { id: "gpt-5.6-sol", displayName: "GPT-5.6 Sol" },
@@ -1978,7 +2336,7 @@ async function listCodexModels() {
   if (codex === "codex") {
     const which = await run("which", ["codex"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_CODEX_MODELS;
-  } else if (!existsSync7(codex)) {
+  } else if (!existsSync8(codex)) {
     return FALLBACK_CODEX_MODELS;
   }
   const listed = await run(codex, ["debug", "models"], { reject: false });
@@ -2013,12 +2371,12 @@ function usageFromCodex(usage) {
 }
 function codexConfigHasNetworkAccess() {
   const candidates = [
-    join5(homedir3(), ".codex", "config.toml"),
-    join5(homedir3(), ".config", "codex", "config.toml")
+    join6(homedir5(), ".codex", "config.toml"),
+    join6(homedir5(), ".config", "codex", "config.toml")
   ];
   for (const path of candidates) {
-    if (!existsSync7(path)) continue;
-    const text = readFileSync3(path, "utf8");
+    if (!existsSync8(path)) continue;
+    const text = readFileSync4(path, "utf8");
     if (/network_access\s*=\s*true/.test(text)) return true;
   }
   return false;
@@ -2043,15 +2401,15 @@ function unwrapCodexMcpResult(result) {
     return String(result);
   }
 }
-function asRecord(value) {
+function asRecord2(value) {
   if (value && typeof value === "object" && !Array.isArray(value)) {
     return value;
   }
   return void 0;
 }
 function codexLooksAuthenticated() {
-  const authPath = join5(homedir3(), ".codex", "auth.json");
-  if (!existsSync7(authPath)) return false;
+  const authPath = join6(homedir5(), ".codex", "auth.json");
+  if (!existsSync8(authPath)) return false;
   try {
     return statSync(authPath).size > 2;
   } catch {
@@ -2063,7 +2421,7 @@ var codexAdapter = {
   async detect() {
     const codex = resolveAgentExecutable("codex");
     if (codex !== "codex") {
-      if (!existsSync7(codex)) {
+      if (!existsSync8(codex)) {
         return {
           agent: "codex",
           installed: false,
@@ -2196,7 +2554,7 @@ var codexAdapter = {
         }
         if (itemType === "mcp_tool_call" && item.id && item.server && item.tool) {
           const name = `mcp__${item.server}__${item.tool}`;
-          const input = asRecord(item.arguments);
+          const input = asRecord2(item.arguments);
           const events = [
             { type: "tool_use", id: item.id, name, input }
           ];
@@ -2337,9 +2695,9 @@ var codexAdapter = {
 };
 
 // src/agents/cursor.ts
-import { existsSync as existsSync8 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 import { createRequire as createRequire3 } from "module";
-import { dirname as dirname4, join as join6 } from "path";
+import { dirname as dirname4, join as join7 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var FALLBACK_CURSOR_MODELS = [
   { id: "default", displayName: "Auto" },
@@ -2406,17 +2764,17 @@ function cursorRunnerPath() {
   if (packaged) return packaged;
   const root = entryDir2();
   const candidates = [
-    join6(root, "agents", "cursor-runner.js"),
-    join6(root, "agents", "cursor-runner.cjs"),
+    join7(root, "agents", "cursor-runner.js"),
+    join7(root, "agents", "cursor-runner.cjs"),
     // If somehow resolved from package root instead of dist/
-    join6(root, "dist", "agents", "cursor-runner.js"),
-    join6(root, "dist", "agents", "cursor-runner.cjs"),
+    join7(root, "dist", "agents", "cursor-runner.js"),
+    join7(root, "dist", "agents", "cursor-runner.cjs"),
     // Source tree (dev): packages/core/src/agents/cursor-runner.ts
-    join6(root, "cursor-runner.ts"),
-    join6(root, "src", "agents", "cursor-runner.ts")
+    join7(root, "cursor-runner.ts"),
+    join7(root, "src", "agents", "cursor-runner.ts")
   ];
   for (const candidate of candidates) {
-    if (existsSync8(candidate)) return candidate;
+    if (existsSync9(candidate)) return candidate;
   }
   return candidates[0];
 }
@@ -2519,11 +2877,11 @@ var cursorAdapter = {
 };
 
 // src/agents/opencode.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 
 // src/agent-rpc/opencode-hook.ts
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 var OPENCODE_PLUGIN_SOURCE = `import { tool } from "@opencode-ai/plugin"
 
 const URL = process.env[${JSON.stringify(AGENT_RPC_URL_ENV)}] || ""
@@ -2628,10 +2986,10 @@ export const SideboardRpc = async (ctx) => {
 }
 `;
 function writeOpencodeRpcPlugin() {
-  const configDir = join7(appDataDir(), "agent-rpc", "opencode");
-  const pluginDir = join7(configDir, "plugins");
+  const configDir = join8(appDataDir(), "agent-rpc", "opencode");
+  const pluginDir = join8(configDir, "plugins");
   mkdirSync2(pluginDir, { recursive: true });
-  const pluginFile = join7(pluginDir, "sideboard-rpc.js");
+  const pluginFile = join8(pluginDir, "sideboard-rpc.js");
   writeFileSync3(pluginFile, OPENCODE_PLUGIN_SOURCE);
   return { configDir, pluginFile };
 }
@@ -2681,7 +3039,7 @@ var FALLBACK_OPENCODE_MODELS = [
 ];
 var cachedOpencodeModels = null;
 var OPENCODE_MODEL_CACHE_MS = 5 * 60 * 1e3;
-function asRecord2(value) {
+function asRecord3(value) {
   if (value && typeof value === "object" && !Array.isArray(value)) {
     return value;
   }
@@ -2726,7 +3084,7 @@ async function listOpencodeModels() {
   if (opencode === "opencode") {
     const which = await run("which", ["opencode"], { reject: false });
     if (which.exitCode !== 0) return FALLBACK_OPENCODE_MODELS;
-  } else if (!existsSync9(opencode)) {
+  } else if (!existsSync10(opencode)) {
     return FALLBACK_OPENCODE_MODELS;
   }
   const listed = await run(opencode, ["models"], { reject: false });
@@ -2761,7 +3119,7 @@ var opencodeAdapter = {
   async detect() {
     const opencode = resolveAgentExecutable("opencode");
     if (opencode !== "opencode") {
-      if (!existsSync9(opencode)) {
+      if (!existsSync10(opencode)) {
         return {
           agent: "opencode",
           installed: false,
@@ -2852,7 +3210,7 @@ var opencodeAdapter = {
         const name = part?.tool ?? part?.name ?? obj.tool ?? obj.name ?? "tool";
         const state = part?.state;
         const input = (state?.input && typeof state.input === "object" ? state.input : void 0) ?? part?.input ?? obj.input;
-        const metadata = asRecord2(state?.metadata);
+        const metadata = asRecord3(state?.metadata);
         const id = opencodeToolId(
           name,
           part?.callID ?? part?.id ?? obj.id,
@@ -2887,7 +3245,7 @@ var opencodeAdapter = {
       }
       if (obj.type === "subtask_event") {
         const parentId = str(obj.childSessionID) ?? str(obj.childSessionId);
-        const part = asRecord2(obj.part);
+        const part = asRecord3(obj.part);
         if (!parentId || !part) return null;
         if (part.type === "text" && str(part.text)) {
           return withTaskParent(
@@ -2898,8 +3256,8 @@ var opencodeAdapter = {
         if (part.type === "tool" || str(part.tool)) {
           const name = str(part.tool) ?? str(part.name) ?? "tool";
           const id = str(part.callID) ?? str(part.id) ?? `${parentId}-${name}`;
-          const state = asRecord2(part.state);
-          const input = asRecord2(state?.input) ?? asRecord2(part.input);
+          const state = asRecord3(part.state);
+          const input = asRecord3(state?.input) ?? asRecord3(part.input);
           const nested = [
             withEventParentId({ type: "tool_use", id, name, input }, parentId)
           ];
@@ -3141,12 +3499,12 @@ function parseSessionQuotaResetAt(text, now = /* @__PURE__ */ new Date()) {
     }
     return at;
   }
-  const relative = text.match(
+  const relative2 = text.match(
     /resets\s+in\s+(\d+)\s*(minutes?|hours?|days?)/i
   );
-  if (relative) {
-    const n = Number(relative[1]);
-    const unit = relative[2].toLowerCase();
+  if (relative2) {
+    const n = Number(relative2[1]);
+    const unit = relative2[2].toLowerCase();
     const ms = unit.startsWith("day") ? n * 24 * 60 * 60 * 1e3 : unit.startsWith("hour") ? n * 60 * 60 * 1e3 : n * 60 * 1e3;
     return new Date(now.getTime() + ms);
   }
@@ -3426,9 +3784,9 @@ function formatClaudeUsageOverLimitWait(windows, now = /* @__PURE__ */ new Date(
 }
 
 // src/agents/claude-usage-client.ts
-import { existsSync as existsSync10, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join8 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join9 } from "path";
 var CLAUDE_OAUTH_USAGE_URL = "https://api.anthropic.com/api/oauth/usage";
 var CLAUDE_USAGE_TTL_MS = 9e4;
 var CLAUDE_USAGE_ERROR_TTL_MS = 5 * 6e4;
@@ -3468,14 +3826,14 @@ function accessTokenFromCredentialsJson(raw) {
   }
 }
 function claudeCredentialsPath(configDir) {
-  const root = configDir?.trim() || process.env.CLAUDE_CONFIG_DIR?.trim() || join8(homedir4(), ".claude");
-  return join8(root, ".credentials.json");
+  const root = configDir?.trim() || process.env.CLAUDE_CONFIG_DIR?.trim() || join9(homedir6(), ".claude");
+  return join9(root, ".credentials.json");
 }
 async function readFileAccessToken(configDir) {
   const path = claudeCredentialsPath(configDir);
-  if (!existsSync10(path)) return null;
+  if (!existsSync11(path)) return null;
   try {
-    return accessTokenFromCredentialsJson(readFileSync4(path, "utf8"));
+    return accessTokenFromCredentialsJson(readFileSync5(path, "utf8"));
   } catch {
     return null;
   }
@@ -3618,6 +3976,12 @@ export {
   adjustBrightsyTurnExit,
   listBrightsyChatTargets,
   brightsyAdapter,
+  matchClaudeMcpTool,
+  parseMcpServerLaunch,
+  uiResourceUriFromMeta,
+  cspFromMeta,
+  htmlFromResourceContent,
+  mcpUiContentSecurityPolicy,
   SIDEBOARD_MCP_PROFILE_ENV,
   SIDEBOARD_THREAD_ID_ENV,
   shouldRegisterMcpWaitForTurn,
@@ -3641,6 +4005,7 @@ export {
   registerPackagedUserMcpClients,
   isInjectedOrchMcpName,
   userMcpNamesToDisable,
+  listUserClaudeMcpServerEntries,
   PLAN_MODE_INSTRUCTION,
   PLAN_MODE_OFF_INSTRUCTION,
   planModeTurnInstruction,