@skaile/workspaces 0.35.0 → 0.36.0

package/dist/{chunk-SKVUDDHE.js → chunk-FDLVPYSN.js}

@@ -1,13 +1,13 @@
-import { WorkspacePlugin } from './chunk-ZGJE4ZDP.js';
+import { WorkspacePlugin } from './chunk-YPRW2ROJ.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { PROTOCOL_VERSION } from './chunk-TDSRLMDB.js';
-import { EventNormalizer } from './chunk-NSVAJWWQ.js';
-import { classifyClaudeSdkError } from './chunk-NGJ6E344.js';
-import { createDriver } from './chunk-CIFTUSBV.js';
+import { EventNormalizer } from './chunk-5IXCNMMU.js';
+import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
+import { createDriver } from './chunk-KM6DCR7A.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-NAMD4AIK.js';
-import { loadConnectorDeclarations, PreMintedSecretProvider, InMemorySecretProvider } from './chunk-52HINMW4.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-JNH6TTIO.js';
+import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider } from './chunk-MCQ4TJ3P.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-DEYYRFQU.js';
 import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-2Q6OY3SU.js';
 import { resolveRuntimeAssets } from './chunk-5DPQ766L.js';
@@ -1070,7 +1070,7 @@ var ExternalMcpManager = class {
   async start(declarations) {
     for (const decl of declarations) {
       try {
-        await this.startServer(decl);
+        await this.addServer(decl);
       } catch (err) {
         this.log.error("MCP server spawn failed; skipping", err, {
           id: decl.id,
@@ -1079,7 +1079,15 @@ var ExternalMcpManager = class {
       }
     }
   }
-  async startServer(decl) {
+  /**
+   * Connect one MCP server and register its tools into the capability registry.
+   * Returns the server id and the registered tool capability names.
+   * Throws if the id is already registered or if connect/listTools fails.
+   */
+  async addServer(decl) {
+    if (this.servers.some((s) => s.id === decl.id)) {
+      throw new Error(`MCP server '${decl.id}' is already registered`);
+    }
     const client = await this.connectWithReauth(decl);
     const server = { id: decl.id, decl, client, toolNames: [] };
     const toolNames = [];
@@ -1106,6 +1114,39 @@ var ExternalMcpManager = class {
       toolCount: toolNames.length,
       tools: toolNames
     });
+    return { id: decl.id, toolNames };
+  }
+  /**
+   * Deregister a running MCP server's tools and close its client.
+   * No-op when the id is not found.
+   *
+   * Drains any in-flight reauth first: a doReauthAndReconnect resolving after
+   * splice would swap server.client to a freshly-connected client that nothing
+   * then closes, leaking the transport/subprocess.
+   */
+  async removeServer(id) {
+    const idx = this.servers.findIndex((s) => s.id === id);
+    if (idx === -1) return;
+    const server = this.servers[idx];
+    if (server.reauthInFlight) await server.reauthInFlight.catch(() => {
+    });
+    this.servers.splice(idx, 1);
+    for (const name of server.toolNames) {
+      this.registry.deregister(name);
+    }
+    try {
+      await server.client.close();
+    } catch {
+    }
+    this.log.info("MCP server removed (runner-managed)", { id });
+  }
+  /** Summary of every currently-connected MCP server. */
+  listServers() {
+    return this.servers.map((s) => ({
+      id: s.id,
+      transport: s.decl.transport ?? "stdio",
+      toolCount: s.toolNames.length
+    }));
   }
   /**
    * Connect, re-minting once on an initial-connect 401: the provisioned bearer
@@ -1252,7 +1293,11 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
     dispose: async () => {
     },
     startWatching: () => {
-    }
+    },
+    getOrCreateExternalMcpManager: () => {
+      throw new Error("external MCP manager unavailable \u2014 no capability registry (CLI/flow mode)");
+    },
+    getExternalMcpManager: () => null
   };
   try {
     registerBuiltinConnectors();
@@ -1280,6 +1325,26 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
     let mcpServers;
     let workspacePluginToShutdown = null;
     let externalMcpManager = null;
+    const mcpSecretChain = preMintedSecrets ? new SecretProviderChain(
+      [preMintedSecrets, secretProvider].filter(
+        Boolean
+      )
+    ) : secretProvider;
+    const getOrCreateExternalMcpManager = () => {
+      if (!capabilityRegistry) {
+        throw new Error(
+          "external MCP manager unavailable \u2014 no capability registry (CLI/flow mode)"
+        );
+      }
+      if (!externalMcpManager) {
+        externalMcpManager = createExternalMcpManager(
+          capabilityRegistry,
+          mcpSecretChain,
+          sessionMeta
+        );
+      }
+      return externalMcpManager;
+    };
     if (driverType === "claude-sdk") {
       const inProcess = await buildInProcessMcpServers(
         resourceManager,
@@ -1294,7 +1359,7 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
       externalMcpManager = await startExternalMcpServers(
         capabilityRegistry,
         projectDir,
-        secretProvider,
+        mcpSecretChain,
         sessionMeta
       );
     } else if (driverType === "claude-sdk") {
@@ -1305,7 +1370,7 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
         sessionMeta
       );
     }
-    if (!resourceManager && driverType !== "claude-sdk" && !externalMcpManager?.hasServers())
+    if (!resourceManager && driverType !== "claude-sdk" && !externalMcpManager?.hasServers() && !capabilityRegistry)
       return noopResult;
     const startWatching = () => {
       if (resourceManager && watch?.onFileChanged) {
@@ -1348,7 +1413,9 @@ async function buildAgentResources(projectDir, driverType, _onLog, watch, secret
       mcpServers,
       runtimeAssets,
       dispose,
-      startWatching
+      startWatching,
+      getOrCreateExternalMcpManager,
+      getExternalMcpManager: () => externalMcpManager
     };
   } catch {
     return noopResult;
@@ -1433,15 +1500,18 @@ async function buildInProcessMcpServers(resourceManager, projectDir, driverType,
 async function startExternalMcpServers(capabilityRegistry, projectDir, secretProvider, sessionMeta) {
   const resolvedDecls = resolveExternalMcpDeclarations(projectDir, sessionMeta?.sessionId);
   if (resolvedDecls.length === 0) return null;
-  const externalMcpManager = new ExternalMcpManager(
+  const mgr = createExternalMcpManager(capabilityRegistry, secretProvider, sessionMeta);
+  await mgr.start(resolvedDecls);
+  return mgr;
+}
+function createExternalMcpManager(capabilityRegistry, secretProvider, sessionMeta) {
+  return new ExternalMcpManager(
     capabilityRegistry,
     secretProvider,
     sessionMeta?.sessionId,
     void 0,
     buildMcpReauthorizer(capabilityRegistry, secretProvider, sessionMeta?.sessionId)
   );
-  await externalMcpManager.start(resolvedDecls);
-  return externalMcpManager;
 }
 function mcpAuthSecretKey(id) {
   return `MCP__${id.replace(/[^A-Za-z0-9_]/g, "_")}__AUTH`;
@@ -1563,7 +1633,9 @@ async function createAgentSession(config) {
     mcpServers,
     runtimeAssets,
     dispose,
-    startWatching
+    startWatching,
+    getOrCreateExternalMcpManager,
+    getExternalMcpManager
   } = await buildAgentResources(
     projectDir,
     driverType,
@@ -1650,6 +1722,8 @@ async function createAgentSession(config) {
     model,
     dispose,
     startWatching,
+    getOrCreateExternalMcpManager,
+    getExternalMcpManager,
     telemetry,
     systemPromptSections
   };
@@ -2867,6 +2941,111 @@ function buildLifecycleHandler(deps) {
     return { ok: true };
   };
 }
+
+// runner/src/session-resource-handlers.ts
+function asDeclaration(declaration) {
+  if (declaration !== null && typeof declaration === "object" && typeof declaration.id === "string" && typeof declaration.driver === "string") {
+    return declaration;
+  }
+  return null;
+}
+function toPreMinted(token) {
+  return { ok: true, token: token.token, expiresAt: token.expiresAt ?? null };
+}
+function buildSessionResourceHandlers(deps) {
+  const { getResourceManager, getPreMintedSecrets, emitResourcesAvailable, log } = deps;
+  async function add(kind, input) {
+    const rm = getResourceManager();
+    if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
+    const decl = asDeclaration(input.declaration);
+    if (!decl) {
+      return { ok: false, code: "invalid_declaration", message: "declaration missing id/driver" };
+    }
+    if (input.preMintedToken) {
+      getPreMintedSecrets()?.set(kind, decl.id, toPreMinted(input.preMintedToken));
+    }
+    try {
+      await rm.connect(decl);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      log(`[session-resource] runner.add_${kind} failed for ${decl.id}: ${message}`);
+      return { ok: false, code: "connect_failed", message };
+    }
+    emitResourcesAvailable();
+    log(`[session-resource] runner.add_${kind} connected ${decl.id}`);
+    return { ok: true, id: decl.id };
+  }
+  return {
+    addConnector: (input) => add("connector", input),
+    addMount: (input) => add("mount", input),
+    removeResource: async (input) => {
+      const rm = getResourceManager();
+      if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
+      if (!rm.has(input.id)) {
+        return { ok: false, code: "not_found", message: `no resource with id ${input.id}` };
+      }
+      try {
+        await rm.disconnect(input.id);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        log(`[session-resource] runner.remove_resource failed for ${input.id}: ${message}`);
+        return { ok: false, code: "disconnect_failed", message };
+      }
+      const ps = getPreMintedSecrets();
+      ps?.unset("connector", input.id);
+      ps?.unset("mount", input.id);
+      emitResourcesAvailable();
+      log(`[session-resource] runner.remove_resource removed ${input.id}`);
+      return { ok: true };
+    },
+    updateCredential: async (input) => {
+      const ps = getPreMintedSecrets();
+      if (!ps) return { ok: false, code: "no_session", message: "session resources not ready" };
+      const rm = getResourceManager();
+      if (rm && !rm.has(input.id)) {
+        return { ok: false, code: "not_found", message: `no resource with id ${input.id}` };
+      }
+      ps.set(input.kind, input.id, input.mint);
+      log(`[session-resource] runner.update_credential staged ${input.kind}:${input.id}`);
+      return { ok: true };
+    }
+  };
+}
+
+// runner/src/mcp-runtime-handlers.ts
+function buildMcpRuntimeHandlers(deps) {
+  return {
+    addMcpServer: async (input) => {
+      const decl = input.declaration;
+      if (!decl?.id) {
+        return { ok: false, code: "invalid_declaration", message: "declaration.id is required" };
+      }
+      const mgr = deps.getOrCreateMcpManager();
+      if (!mgr) return { ok: false, code: "no_session", message: "session resources not ready" };
+      if (input.preMintedToken) {
+        deps.getPreMintedSecrets()?.set("mcp", decl.id, toPreMinted(input.preMintedToken));
+      }
+      try {
+        const { toolNames } = await mgr.addServer(decl);
+        deps.emitResourcesAvailable();
+        deps.log(
+          `[mcp-runtime] runner.add_mcp_server connected ${decl.id} (${toolNames.length} tools)`
+        );
+        return {
+          ok: true,
+          id: decl.id,
+          live: deps.driverPicksUpToolsLive(),
+          toolCount: toolNames.length
+        };
+      } catch (err) {
+        deps.getPreMintedSecrets()?.unset("mcp", decl.id);
+        const message = err instanceof Error ? err.message : String(err);
+        const code = message.includes("already registered") ? "mcp_already_registered" : "mcp_connect_failed";
+        return { ok: false, code, message };
+      }
+    }
+  };
+}
 function parseFleetHealthBody(body) {
   return body.trim().toLowerCase() === "healthy" ? "healthy" : "error";
 }
@@ -2958,6 +3137,10 @@ var connectorDeclarationInput = z5.strictObject({
   declaration: requiredUnknown,
   preMintedToken: preMintedTokenSchema
 });
+var addMcpServerInputSchema = z5.strictObject({
+  declaration: requiredUnknown,
+  preMintedToken: preMintedTokenSchema
+});
 var removeResourceInput = z5.strictObject({
   id: z5.string()
 });
@@ -3018,6 +3201,24 @@ function buildRunnerCapabilities(handlers) {
         });
       }
     }),
+    // TODO(mcp-detach): no runner.remove_mcp_server yet — live MCP detach + mcp: credential cleanup deferred with the attach-by-ref rework.
+    defineCapability({
+      name: "runner.add_mcp_server",
+      displayName: "Add MCP server",
+      description: "Live-attach a remote MCP server to the running session. Used by the platform to connect additional MCP tool servers mid-session.",
+      side: "agent",
+      origin: RUNNER_CAP_ORIGIN,
+      audience: ["runtime"],
+      kind: "effect",
+      input: addMcpServerInputSchema,
+      handler: async (input) => {
+        if (!handlers.addMcpServer) return notImplemented("runner.add_mcp_server");
+        return handlers.addMcpServer({
+          declaration: input.declaration,
+          preMintedToken: input.preMintedToken
+        });
+      }
+    }),
     defineCapability({
       name: "runner.remove_resource",
       displayName: "Remove resource",
@@ -3157,76 +3358,6 @@ function extractClaudeAiOauthExpiresAt(json) {
   return null;
 }
 
-// runner/src/session-resource-handlers.ts
-function asDeclaration(declaration) {
-  if (declaration !== null && typeof declaration === "object" && typeof declaration.id === "string" && typeof declaration.driver === "string") {
-    return declaration;
-  }
-  return null;
-}
-function toPreMinted(token) {
-  return { ok: true, token: token.token, expiresAt: token.expiresAt ?? null };
-}
-function buildSessionResourceHandlers(deps) {
-  const { getResourceManager, getPreMintedSecrets, emitResourcesAvailable, log } = deps;
-  async function add(kind, input) {
-    const rm = getResourceManager();
-    if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
-    const decl = asDeclaration(input.declaration);
-    if (!decl) {
-      return { ok: false, code: "invalid_declaration", message: "declaration missing id/driver" };
-    }
-    if (input.preMintedToken) {
-      getPreMintedSecrets()?.set(kind, decl.id, toPreMinted(input.preMintedToken));
-    }
-    try {
-      await rm.connect(decl);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      log(`[session-resource] runner.add_${kind} failed for ${decl.id}: ${message}`);
-      return { ok: false, code: "connect_failed", message };
-    }
-    emitResourcesAvailable();
-    log(`[session-resource] runner.add_${kind} connected ${decl.id}`);
-    return { ok: true, id: decl.id };
-  }
-  return {
-    addConnector: (input) => add("connector", input),
-    addMount: (input) => add("mount", input),
-    removeResource: async (input) => {
-      const rm = getResourceManager();
-      if (!rm) return { ok: false, code: "no_session", message: "session resources not ready" };
-      if (!rm.has(input.id)) {
-        return { ok: false, code: "not_found", message: `no resource with id ${input.id}` };
-      }
-      try {
-        await rm.disconnect(input.id);
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        log(`[session-resource] runner.remove_resource failed for ${input.id}: ${message}`);
-        return { ok: false, code: "disconnect_failed", message };
-      }
-      const ps = getPreMintedSecrets();
-      ps?.unset("connector", input.id);
-      ps?.unset("mount", input.id);
-      emitResourcesAvailable();
-      log(`[session-resource] runner.remove_resource removed ${input.id}`);
-      return { ok: true };
-    },
-    updateCredential: async (input) => {
-      const ps = getPreMintedSecrets();
-      if (!ps) return { ok: false, code: "no_session", message: "session resources not ready" };
-      const rm = getResourceManager();
-      if (rm && !rm.has(input.id)) {
-        return { ok: false, code: "not_found", message: `no resource with id ${input.id}` };
-      }
-      ps.set(input.kind, input.id, input.mint);
-      log(`[session-resource] runner.update_credential staged ${input.kind}:${input.id}`);
-      return { ok: true };
-    }
-  };
-}
-
 // runner/src/session-stimulus.ts
 var DEFAULT_COALESCE_MS = 50;
 function createSessionStimulusBus(opts) {
@@ -3371,6 +3502,11 @@ function splitConnectorsForWire(manager) {
   }
   return { mounts, connectors };
 }
+function buildResourcesAvailablePayload(manager, mcpManager, driverLive) {
+  const { mounts, connectors } = splitConnectorsForWire(manager);
+  const mcp_servers = (mcpManager?.listServers() ?? []).map((s) => ({ ...s, live: driverLive }));
+  return { type: "resources_available", mounts, connectors, mcp_servers };
+}
 function findAiAssetsRoot(startDir) {
   let dir = startDir;
   for (let i = 0; i < 6; i++) {
@@ -4137,10 +4273,15 @@ async function startAgentServer(opts) {
       driver = agentSession.driver;
       rebuildCompactionOrchestrator();
       registerSessionComposition(agentSession);
-      sendEvent({
-        type: "resources_available",
-        ...splitConnectorsForWire(resourceManager)
-      });
+      const driverPicksUpToolsLive = () => agentSession?.driverType !== "claude-sdk";
+      const emitResourcesAvailable = () => sendEvent(
+        buildResourcesAvailablePayload(
+          resourceManager,
+          agentSession?.getExternalMcpManager(),
+          driverPicksUpToolsLive()
+        )
+      );
+      emitResourcesAvailable();
       agentSession.startWatching();
       capabilityRegistry.setRemoteInvoker(remoteCapabilityInvoker);
       const runnerCaps = buildRunnerCapabilities({
@@ -4150,12 +4291,16 @@ async function startAgentServer(opts) {
         ...buildSessionResourceHandlers({
           getResourceManager: () => resourceManager,
           getPreMintedSecrets: () => preMintedSecrets,
-          emitResourcesAvailable: () => {
-            sendEvent({
-              type: "resources_available",
-              ...splitConnectorsForWire(resourceManager)
-            });
-          },
+          emitResourcesAvailable,
+          log
+        }),
+        // runner.add_mcp_server — wired to the live session's lazily-created
+        // ExternalMcpManager + PreMintedSecretProvider.
+        ...buildMcpRuntimeHandlers({
+          getOrCreateMcpManager: () => agentSession?.getOrCreateExternalMcpManager() ?? null,
+          getPreMintedSecrets: () => preMintedSecrets ?? null,
+          driverPicksUpToolsLive,
+          emitResourcesAvailable,
           log
         }),
         // setLogLevel left undefined (the cap self-falls-back to getLogStore);
@@ -4856,12 +5001,17 @@ async function startAgentServer(opts) {
     agentSession.startWatching();
   }
   function emitAvailabilityOnConnect() {
-    if (resourceManager) {
-      const wire = splitConnectorsForWire(resourceManager);
+    if (resourceManager || agentSession?.getExternalMcpManager()) {
+      const driverLive = agentSession?.driverType !== "claude-sdk";
+      const payload = buildResourcesAvailablePayload(
+        resourceManager,
+        agentSession?.getExternalMcpManager() ?? null,
+        driverLive
+      );
       log(
-        `[serve] emitting resources_available: ${wire.mounts.length} mount(s), ${wire.connectors.length} connector(s)`
+        `[serve] emitting resources_available: ${payload.mounts.length} mount(s), ${payload.connectors.length} connector(s)`
       );
-      sendEvent({ type: "resources_available", ...wire });
+      sendEvent(payload);
     }
     const commands = driver?.getSlashCommands?.() ?? [];
     if (commands.length > 0) {
@@ -5044,6 +5194,6 @@ function touchSession(state) {
   return { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 
-export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-SKVUDDHE.js.map
-//# sourceMappingURL=chunk-SKVUDDHE.js.map
+export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
+//# sourceMappingURL=chunk-FDLVPYSN.js.map
+//# sourceMappingURL=chunk-FDLVPYSN.js.map