@skaile/workspaces 3.18.0 → 3.19.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 3.19.0
+
+### Minor Changes
+
+- [#674](https://github.com/skaile-ai/workspaces/pull/674) [`95ff13e`](https://github.com/skaile-ai/workspaces/commit/95ff13ef72e86c721b9107744ed4cc5614794e81) Thanks [@peteralbert](https://github.com/peteralbert)! - Add explicit approve-once/deny managed MCP consent using the original native callback and configured transport binding. Preserve the native elicitation envelope in the generated protocol; reject unsupported approval forms, stale replies and changed bindings through the final RPC write. Consent cards add the `mcp` kind with bounded durable presentation, without replacing capability or Platform authorization.
+
+  Update strict consent consumers as described in MIGRATION.md. Synthetic driver/runner regressions and a separately constrained allowed-only fixture harness do not establish native/provider readiness or production activation.
+
+  Sample final passive MCP counters after owned transport closure, so rejected post-terminal SDK entries cannot disappear from the final audit. Uncertain closure or a failed counter read does not claim a completed final sample.
+
 ## 3.18.0
 
 ### Minor Changes

package/dist/{asset-feeds-LT4GI576.js → asset-feeds-OO3NIRVI.js}

@@ -65,7 +65,7 @@ async function libraryAssets() {
   const domains = [];
   try {
     const [{ openLibraryManager }, { skaileHomeDir }, { getGlobalCacheDir }] = await Promise.all([
-      import('./open-library-ZDM6DUKJ.js'),
+      import('./open-library-2AWZGIWE.js'),
       import('./library/index.js'),
       import('./core/index.js')
     ]);
@@ -98,7 +98,7 @@ async function libraryAssets() {
 async function storeAssets(projectDir) {
   const notes = [];
   try {
-    const { resolveCatalogSource } = await import('./open-library-ZDM6DUKJ.js');
+    const { resolveCatalogSource } = await import('./open-library-2AWZGIWE.js');
     const { source, close } = await resolveCatalogSource({ projectDir });
     try {
       const assets = await source.listAssets();
@@ -202,5 +202,5 @@ function dedupeBySlug(domains) {
 }
 
 export { gatherAssetFeeds };
-//# sourceMappingURL=asset-feeds-LT4GI576.js.map
-//# sourceMappingURL=asset-feeds-LT4GI576.js.map
+//# sourceMappingURL=asset-feeds-OO3NIRVI.js.map
+//# sourceMappingURL=asset-feeds-OO3NIRVI.js.map

package/dist/{asset-feeds-LT4GI576.js.map → asset-feeds-OO3NIRVI.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/asset-feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAqFA,SAAS,QAAQ,CAAA,EAAmB;AAClC,EAAA,OAAO,CAAA,CAAE,KAAA,CAAW,IAAA,CAAA,GAAG,CAAA,CAAE,KAAK,GAAG,CAAA;AACnC;AAGA,eAAe,cAAc,IAAA,EAAmC;AAC9D,EAAA,MAAM,MAAkB,EAAC;AACzB,EAAA,WAAA,MAAiB,EAAE,IAAA,EAAM,QAAA,EAAU,MAAK,IAAK,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC1D,IAAA,IAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,iBAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAChE,MAAA,GAAA,CAAI,IAAA,CAAK,cAAc,OAAA,CAAa,IAAA,CAAA,QAAA,CAAS,MAAM,QAAQ,CAAC,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,IACtE,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACX;AACA,EAAA,OAAO,GAAA;AACT;AAcA,eAAe,YAAA,CACb,IAAA,EACA,YAAA,EACA,OAAA,EACA,qBAAqB,IAAA,EACK;AAC1B,EAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,IAAI,CAAA;AAC1C,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,IAC1C,KAAA;AAAA,IACA,KAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAAA,IAChC,cAAc,OAAA,CAAa,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,KAAA,CAAM,MAAM,CAAC;AAAA,GACzD,CAAE,CAAA;AAEF,EAAA,IAAI,YAAA,GAAe,KAAA;AACnB,EAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,IAAA,MAAM,IAAA,GAAO,YAAA,CAAa,CAAA,CAAE,YAAA,EAAc,SAAS,CAAA;AACnD,IAAA,IAAI,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,SAAA,IACtB,kBAAA,EAAoB;AAC3B,MAAA,CAAA,CAAE,MAAM,UAAA,GAAa,YAAA;AACrB,MAAA,YAAA,GAAe,IAAA;AAAA,IACjB,CAAA,MAAO,CAAA,CAAE,KAAA,CAAM,UAAA,GAAa,EAAA;AAAA,EAC9B;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACzD,EAAA,MAAM,UAA2B,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,IAChE,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,GAAI,EAAE,WAAA,GAAc,EAAE,aAAa,CAAA,CAAE,WAAA,KAAgB,EAAC;AAAA,IACtD,GAAI,EAAE,QAAA,GAAW,EAAE,UAAU,CAAA,CAAE,QAAA,KAAa,EAAC;AAAA,IAC7C,GAAI,EAAE,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,IAClD,GAAI,CAAA,CAAE,WAAA,CAAY,CAAC,CAAA,GAAI,EAAE,cAAA,EAAgB,CAAA,CAAE,WAAA,CAAY,CAAC,CAAA,EAAE,GAAI;AAAC,GACjE,CAAE,CAAA;AACF,EAAA,IAAI,YAAA,UAAsB,IAAA,CAAK,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,cAAc,CAAA;AAC1E,EAAA,OAAO,OAAA;AACT;AAUA,eAAe,aAAA,GAIZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,MAAM,UAA2B,EAAC;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,EAAE,kBAAA,EAAmB,EAAG,EAAE,aAAA,EAAc,EAAG,EAAE,iBAAA,EAAmB,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,MAC3F,OAAO,4BAAmB,CAAA;AAAA,MAC1B,OAAO,oBAA4B,CAAA;AAAA,MACnC,OAAO,iBAAyB;AAAA,KACjC,CAAA;AACD,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,IAAA,IAAI;AAIF,MAAA,MAAM,UAAU,iBAAA,EAAkB;AAClC,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,aAAA,EAAc,EAAG,SAAS,CAAA;AACvD,MAAA,MAAM,IAAA,GAAA,CAAQ,MAAM,OAAA,CAAQ,aAAA,EAAc,EAAG,MAAA;AAAA,QAC3C,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA,IAAK,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,UAAU;AAAA,OACrE;AACA,MAAA,MAAM,UAAyB,EAAC;AAChC,MAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,QAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAI3B,QAAA,MAAM,UAAA,GAAa,CAAC,GAAI,MAAM,SAAS,GAAA,CAAI,IAAA,EAAM,GAAA,CAAI,IAAI,CAAE,CAAA;AAC3D,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAI,MAAM,YAAA,CAAa,GAAA,CAAI,MAAM,GAAA,CAAI,IAAA,EAAM,UAAA,EAAY,KAAK,CAAE,CAAA;AAC3E,QAAA,KAAA,MAAW,KAAA,IAAS,UAAA,EAAY,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,MAC5F;AACA,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,IACnC,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,SAAS,KAAA,EAAM;AAAA,EACvC;AACF;AAYA,eAAe,YAAY,UAAA,EAIxB;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACjE,IAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,MAAM,oBAAA,CAAqB,EAAE,YAAY,CAAA;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,MAAA,MAAM,OAAA,GAA0B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,IAAA,EAAO,EAAE,IAAA,IAAsB,OAAA;AAAA,QAC/B,WAAA,EAAa,EAAE,WAAA,IAAe,EAAA;AAAA,QAC9B,MAAA,EAAQ,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,CAAA;AAAA,QACvB,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,YAAY,CAAA,CAAE,UAAA;AAAA,QACd,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OACjB,CAAE,CAAA;AAIF,MAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,MAAM,CAAA;AACxC,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,IACnC,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG3D,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAK,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,IAAI,OAAA,EAAS,IAAI,KAAA,EAAM;AAAA,EAC3C;AACF;AAGA,eAAe,YAAY,MAAA,EAA2C;AACpE,EAAA,MAAM,KAAM,MAAA,CAA4D,WAAA;AACxE,EAAA,IAAI,OAAO,EAAA,KAAO,UAAA,EAAY,OAAO,EAAC;AACtC,EAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,IAAA,CAAK,MAAM,CAAA;AACpC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,UAAU,EAAC;AAC7C;AAcA,eAAe,aACb,EAAA,EAC+D;AAI/D,EAAA,MAAM,eAAA,GAAkB,iBAAA,EAAkB,CAAE,GAAA,CAAI,CAAC,CAAA,KAAO,CAAA,CAAE,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,CAAA,GAAI,CAAA,GAAS,IAAA,CAAA,GAAI,CAAA;AAChG,EAAA,MAAM,gBAAgB,CAAC,CAAA,KACrB,eAAA,CAAgB,IAAA,CAAK,CAAC,EAAA,KAAO,CAAA,KAAM,EAAA,CAAG,KAAA,CAAM,GAAG,EAAE,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,EAAE,CAAC,CAAA;AAExE,EAAA,MAAM,GAAA,GAAA,CAAO,MAAM,EAAA,CAAG,MAAA,EAAO,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AACtE,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,UAA2B,EAAC;AAMlC,EAAA,KAAA,MAAW,EAAE,QAAA,EAAU,IAAA,EAAK,IAAK,EAAA,CAAG,iBAAgB,EAAG;AACrD,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACzB,IAAA,MAAM,SAAS,IAAA,CAAK,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,OAAO,IAAA,GAAY,IAAA,CAAA,GAAA;AAC5D,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,IAAA,IAAQ,CAAA,CAAE,MAAA,CAAO,UAAA,CAAW,MAAM,CAAC,CAAA;AAChF,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACxB,IAAA,MAAM,aAAa,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,QAAA;AAGhD,IAAA,OAAA,CAAQ,IAAA,CAAK,GAAI,MAAM,YAAA,CAAa,MAAM,UAAA,EAAY,KAAA,EAAO,KAAK,CAAE,CAAA;AACpE,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,EAAE,QAAQ,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,EAAE,SAAS,OAAA,EAAQ;AAC5B;AAUA,eAAe,aAAA,GAIZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,MAAM,UAA2B,EAAC;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,IAAA,IAAQ,mBAAkB,EAAG;AACtC,MAAA,MAAM,cAAc,CAAC,GAAI,MAAM,QAAA,CAAS,IAAA,EAAM,gBAAgB,CAAE,CAAA;AAChE,MAAA,OAAA,CAAQ,KAAK,GAAI,MAAM,aAAa,IAAA,EAAM,gBAAA,EAAkB,WAAW,CAAE,CAAA;AACzE,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,WAAW,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,EACnC,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,SAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,SAAS,KAAA,EAAM;AAAA,EACvC;AACF;AAGA,SAAS,GAAA,CAAI,QAAqB,OAAA,EAAwC;AACxE,EAAA,OAAO,QAAQ,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAM,CAAE,CAAA;AACnD;AASA,eAAsB,gBAAA,CACpB,IACA,UAAA,EAC0B;AAC1B,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,aAAA,EAAc,EAAG,WAAA,CAAY,UAAU,CAAC,CAAC,CAAA;AAClF,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,EAAc;AACpC,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,EAAE,CAAA;AACjC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP,GAAG,GAAA,CAAI,OAAA;AAAA,MACP,GAAG,IAAA,CAAK,OAAA;AAAA,MACR,GAAG,GAAA,CAAI,SAAA,EAAW,OAAA,CAAQ,OAAO,CAAA;AAAA,MACjC,GAAG,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,OAAO;AAAA,KAC/B;AAAA;AAAA;AAAA,IAGA,OAAA,EAAS,YAAA,CAAa,CAAC,GAAG,MAAM,OAAA,EAAS,GAAG,GAAA,CAAI,OAAA,EAAS,GAAG,IAAA,CAAK,OAAA,EAAS,GAAG,OAAA,CAAQ,OAAO,CAAC,CAAA;AAAA,IAC7F,KAAA,EAAO,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,GAAG,KAAA,CAAM,KAAA,EAAO,GAAG,OAAA,CAAQ,KAAK;AAAA,GACzD;AACF;AAGA,SAAS,aAAa,OAAA,EAA2C;AAC/D,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAA,EAAG;AACtB,IAAA,IAAA,CAAK,GAAA,CAAI,EAAE,IAAI,CAAA;AACf,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,OAAO,GAAA;AACT","file":"asset-feeds-LT4GI576.js","sourcesContent":["/**\n * asset-feeds.ts — gather installable assets from every feed the manage TUI\n * surfaces.\n *\n * Four feeds, normalized into `CatalogEntry`:\n * - **Project sources** — `skaile.yaml` `sources:` entries (scanned via\n *   `AssetManager.search()`; the new `sources:` field is merged into the\n *   legacy repositories map in `AssetManager.loadConfig`).\n * - **Local libraries** — user authoring places from `LocalIndex` (filesystem\n *   scan of each library's `path`).\n * - **Factory assets** — the bundled first-party `factory-assets` tree\n *   (`factoryAssetRoots()`), scanned from disk. Always present; no network.\n * - **Remote store** — the configured catalog source when `catalog.url` is\n *   not `local`. Failures are non-fatal — they surface as notes.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  type AssetKind,\n  type CatalogDomain,\n  type CatalogEntry,\n  factoryAssetRoots,\n  parseFrontmatter,\n  scanRepo,\n  walkDir,\n} from \"@skaile/workspaces/core\";\nimport {\n  assignDomain,\n  buildDomainIndex,\n  DOMAIN_MD_FILENAME,\n  type DomainMd,\n  parseDomainMd,\n} from \"@skaile/workspaces/discovery\";\n\n/** One non-fatal note returned to the caller for surfacing in the UI. */\nexport interface FeedNote {\n  feed: \"sources\" | \"libraries\" | \"store\" | \"factory\";\n  message: string;\n}\n\n/**\n * Which feed an asset came from. This is the top-level grouping axis in the\n * manage TUI (\"where is this skill coming from?\") and is intentionally distinct\n * from `publisher` (asset-intrinsic identity): the same publisher can legitimately\n * appear under more than one origin (e.g. a github repo you added as a `source`\n * that is also listed in the remote `store`).\n */\nexport type AssetOrigin = \"source\" | \"library\" | \"factory\" | \"store\";\n\n/** A catalog entry tagged with the feed it was gathered from. */\nexport interface OriginEntry {\n  origin: AssetOrigin;\n  entry: CatalogEntry;\n  /**\n   * Second-level grouping label for the manage tree. Defaults (when unset) to the\n   * entry's `publisher`; the source feed sets it to the source's short repo name\n   * so the Sources band groups by source — \"which repo did this come from\" — not\n   * by the asset-intrinsic publisher.\n   */\n  group?: string;\n}\n\nexport interface AssetFeedResult {\n  entries: OriginEntry[];\n  /**\n   * Display-only domain metadata, keyed (by the consumer) on `slug`. Populated\n   * from the store's `catalog.listDomains` when the connected catalog source\n   * exposes it; empty otherwise. The manage TUI joins `entry.domainSlug` → a\n   * domain for grouping headers, descriptions, and relation badges.\n   */\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}\n\n// ── Domain stamping (on-disk feeds) ──────────────────────────────────────────\n//\n// `scanRepo` (the source / library / factory scan path) does not read the\n// `DOMAIN.md` sidecars, so its entries arrive with no `domainSlug` and render\n// flat under their publisher band. We re-derive the grouping here from the\n// root's `DOMAIN.md` files (the same sidecars the remote store computes\n// server-side), and fall back to the repo/source name for any entry no domain\n// claims so it still groups instead of landing in the synthetic \"no domain\" pile.\n\n/** Repo-relative POSIX path (DOMAIN.md slugs are matched whole-segment, `/`-joined). */\nfunction toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** Parse every `DOMAIN.md` sidecar under `root` into a {@link DomainMd}. */\nasync function loadDomainMds(root: string): Promise<DomainMd[]> {\n  const out: DomainMd[] = [];\n  for await (const { path: filePath, name } of walkDir(root)) {\n    if (name !== DOMAIN_MD_FILENAME) continue;\n    try {\n      const { data } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n      out.push(parseDomainMd(toPosix(path.relative(root, filePath)), data));\n    } catch {}\n  }\n  return out;\n}\n\n/**\n * Stamp `domainSlug` onto every entry scanned from `root` using the root's\n * `DOMAIN.md` sidecars. Returns the `CatalogDomain` registry for the real\n * domains, plus a synthetic fallback domain when any entry used the fallback.\n * Mutates `entries` in place (sets `entry.domainSlug`).\n *\n * `synthesizeFallback` (default true): entries no domain claims fall back to\n * `fallbackSlug` (the repo/source name). Pass `false` when the caller already\n * groups these entries one level up (e.g. the source feed groups by source\n * node) — unmatched entries then get no domain (`\"\"`) and hang directly under\n * that parent, instead of nesting under a same-named fallback domain.\n */\nasync function stampDomains(\n  root: string,\n  fallbackSlug: string,\n  entries: CatalogEntry[],\n  synthesizeFallback = true,\n): Promise<CatalogDomain[]> {\n  const domainMds = await loadDomainMds(root);\n  const assignables = entries.map((entry) => ({\n    entry,\n    ref: `${entry.kind}:${entry.name}`,\n    relativePath: toPosix(path.relative(root, entry.source)),\n  }));\n\n  let usedFallback = false;\n  for (const a of assignables) {\n    const slug = assignDomain(a.relativePath, domainMds);\n    if (slug) a.entry.domainSlug = slug;\n    else if (synthesizeFallback) {\n      a.entry.domainSlug = fallbackSlug;\n      usedFallback = true;\n    } else a.entry.domainSlug = \"\";\n  }\n\n  const { index } = buildDomainIndex(assignables, domainMds);\n  const catalog: CatalogDomain[] = Object.values(index).map((d) => ({\n    slug: d.slug,\n    title: d.title,\n    ...(d.description ? { description: d.description } : {}),\n    ...(d.relation ? { relation: d.relation } : {}),\n    ...(d.order !== undefined ? { order: d.order } : {}),\n    ...(d.recommended[0] ? { recommendedRef: d.recommended[0] } : {}),\n  }));\n  if (usedFallback) catalog.push({ slug: fallbackSlug, title: fallbackSlug });\n  return catalog;\n}\n\n/**\n * Pull assets from local libraries (the authoring places under\n * `~/.skaile/libraries/<name>/`, not the `~/.skaile/cache/sources/` cache). Each\n * library's `path` is scanned with `scanRepo` and grouped under the bare library\n * name (`group: <name>`) so the manage TUI shows a clean `<name>` band — no\n * `library:` prefix and no redundant same-named fallback domain (mirrors the\n * source feed).\n */\nasync function libraryAssets(): Promise<{\n  entries: OriginEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  const domains: CatalogDomain[] = [];\n  try {\n    const [{ openLibraryManager }, { skaileHomeDir }, { getGlobalCacheDir }] = await Promise.all([\n      import(\"./open-library.ts\"),\n      import(\"@skaile/workspaces/library\"),\n      import(\"@skaile/workspaces/core\"),\n    ]);\n    const { manager, close } = await openLibraryManager();\n    try {\n      // Authoring libraries are the rows that are NOT source clones. index.db\n      // rows predating the cache migration still carry the legacy\n      // ~/.skaile/sources path, so exclude both roots.\n      const newRoot = getGlobalCacheDir();\n      const legacyRoot = path.join(skaileHomeDir(), \"sources\");\n      const libs = (await manager.listLibraries()).filter(\n        (l) => !l.path.startsWith(newRoot) && !l.path.startsWith(legacyRoot),\n      );\n      const entries: OriginEntry[] = [];\n      for (const lib of libs) {\n        if (!existsSync(lib.path)) continue;\n        // Scan + group under the bare library name. `synthesizeFallback: false`\n        // (as the source feed does) keeps domainless assets directly under the\n        // library band instead of a redundant same-named fallback domain.\n        const libEntries = [...(await scanRepo(lib.path, lib.name))];\n        domains.push(...(await stampDomains(lib.path, lib.name, libEntries, false)));\n        for (const entry of libEntries) entries.push({ origin: \"library\", entry, group: lib.name });\n      }\n      return { entries, domains, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    notes.push({\n      feed: \"libraries\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], domains, notes };\n  }\n}\n\n/**\n * Pull a (best-effort) snapshot of the connected remote store catalog.\n *\n * - Returns no entries when the resolved catalog is local-only or the host\n *   is unreachable (the failure becomes a note, not an exception).\n * - Maps `CatalogAsset` → `CatalogEntry`, carrying `publisher`, `repo`, and\n *   `category` straight through and using `source = \"store://<id>\"`; per-file\n *   `source` paths are not available for remote assets so the canonical ref is\n *   a stable placeholder.\n */\nasync function storeAssets(projectDir: string): Promise<{\n  entries: CatalogEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { resolveCatalogSource } = await import(\"./open-library.ts\");\n    const { source, close } = await resolveCatalogSource({ projectDir });\n    try {\n      const assets = await source.listAssets();\n      const entries: CatalogEntry[] = assets.map((a) => ({\n        name: a.name,\n        kind: (a.kind as AssetKind) ?? \"skill\",\n        description: a.description ?? \"\",\n        source: `store://${a.id}`,\n        publisher: a.publisher,\n        repo: a.repo,\n        domainSlug: a.domainSlug,\n        category: a.category,\n        version: a.version,\n        requires: [],\n        dependencies: [],\n      }));\n      // Domains are optional on the catalog source — only the store backend\n      // (post Part 4 `catalog.listDomains`) exposes them. Duck-type the call so\n      // older sources and the local catalog degrade to no domains, not an error.\n      const domains = await loadDomains(source);\n      return { entries, domains, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    // Local-only catalog throws a recognizable message — silence it; absence\n    // is the user's choice, not an error.\n    if (!/local/i.test(msg)) {\n      notes.push({ feed: \"store\", message: msg });\n    }\n    return { entries: [], domains: [], notes };\n  }\n}\n\n/** Optional `listDomains` capability — returns `[]` when the source lacks it. */\nasync function loadDomains(source: unknown): Promise<CatalogDomain[]> {\n  const fn = (source as { listDomains?: () => Promise<CatalogDomain[]> }).listDomains;\n  if (typeof fn !== \"function\") return [];\n  const domains = await fn.call(source);\n  return Array.isArray(domains) ? domains : [];\n}\n\n/** The slice of `AssetManager` the source feed needs (kept narrow for tests). */\ninterface AssetManagerLike {\n  search: () => Promise<CatalogEntry[]>;\n  searchRepoRoots: () => { repoName: string; root: string }[];\n}\n\n/**\n * Project-source feed: leans on `AssetManager.search()`, which now merges\n * `skaile.yaml`'s `sources:` field into the repositories map, then stamps\n * `DOMAIN.md`-derived domain grouping onto the scanned entries via\n * `searchRepoRoots()`.\n */\nasync function sourceAssets(\n  am: AssetManagerLike,\n): Promise<{ entries: OriginEntry[]; domains: CatalogDomain[] }> {\n  // The bundled factory tree is injected into the repositories map as an implicit\n  // source, so `am.search()` returns it too. It has its own `factory` origin band,\n  // so drop it here — otherwise the same first-party skills list twice under Sources.\n  const factoryPrefixes = factoryAssetRoots().map((r) => (r.endsWith(path.sep) ? r : r + path.sep));\n  const isFactoryPath = (p: string) =>\n    factoryPrefixes.some((fp) => p === fp.slice(0, -1) || p.startsWith(fp));\n\n  const all = (await am.search()).filter((e) => !isFactoryPath(e.source));\n  const entries: OriginEntry[] = [];\n  const domains: CatalogDomain[] = [];\n  // Group each source's entries under the source node (its short repo name), not\n  // the publisher: under Sources the navigational question is \"which repo did\n  // this come from\". Each entry's `source` (absolute manifest path) lives under\n  // exactly one declared root, so group + stamp by prefix. The cache slug is\n  // URL-keyed `github.com/<org>/<repo>` — take the trailing segment.\n  for (const { repoName, root } of am.searchRepoRoots()) {\n    if (isFactoryPath(root)) continue;\n    const prefix = root.endsWith(path.sep) ? root : root + path.sep;\n    const owned = all.filter((e) => e.source === root || e.source.startsWith(prefix));\n    if (owned.length === 0) continue;\n    const sourceName = repoName.split(\"/\").pop() || repoName;\n    // No synthetic fallback domain — the source node already groups these, so a\n    // same-named fallback would just nest the source under itself.\n    domains.push(...(await stampDomains(root, sourceName, owned, false)));\n    for (const entry of owned) entries.push({ origin: \"source\", entry, group: sourceName });\n  }\n  return { entries, domains };\n}\n\n/**\n * Factory-asset feed: scan the bundled first-party `factory-assets` tree(s)\n * resolved by `factoryAssetRoots()` (the `SKAILE_FACTORY_ASSETS_DIR` override\n * layer ahead of the bundled tree). Local disk only, no network — the entries are\n * the built-in skills / connectors / bundles that ship with `@skaile/workspaces`.\n * `factoryAssetRoots()` already dedupes, so the env override pointing at the\n * bundled dir collapses to one root.\n */\nasync function factoryAssets(): Promise<{\n  entries: CatalogEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  const domains: CatalogDomain[] = [];\n  try {\n    const entries: CatalogEntry[] = [];\n    for (const root of factoryAssetRoots()) {\n      const rootEntries = [...(await scanRepo(root, \"skaile-factory\"))];\n      domains.push(...(await stampDomains(root, \"skaile-factory\", rootEntries)));\n      entries.push(...rootEntries);\n    }\n    return { entries, domains, notes };\n  } catch (err) {\n    notes.push({\n      feed: \"factory\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], domains, notes };\n  }\n}\n\n/** Tag a flat entry list with a single origin. */\nfunction tag(origin: AssetOrigin, entries: CatalogEntry[]): OriginEntry[] {\n  return entries.map((entry) => ({ origin, entry }));\n}\n\n/**\n * Run all feeds and return a single normalized result.\n *\n * Feeds run in parallel where possible — the store fetch is the slow one\n * (one HTTP call) and is fired alongside the local library walk. The factory\n * scan is local disk only, so it runs inline.\n */\nexport async function gatherAssetFeeds(\n  am: AssetManagerLike,\n  projectDir: string,\n): Promise<AssetFeedResult> {\n  const [libs, store] = await Promise.all([libraryAssets(), storeAssets(projectDir)]);\n  const factory = await factoryAssets();\n  const src = await sourceAssets(am);\n  return {\n    entries: [\n      ...src.entries,\n      ...libs.entries,\n      ...tag(\"factory\", factory.entries),\n      ...tag(\"store\", store.entries),\n    ],\n    // Store domains first (server-curated), then the on-disk feeds; dedupe by\n    // slug, first-wins, so a store-served domain shadows a same-slug local one.\n    domains: dedupeBySlug([...store.domains, ...src.domains, ...libs.domains, ...factory.domains]),\n    notes: [...libs.notes, ...store.notes, ...factory.notes],\n  };\n}\n\n/** First-wins dedupe of a domain list by `slug`. */\nfunction dedupeBySlug(domains: CatalogDomain[]): CatalogDomain[] {\n  const seen = new Set<string>();\n  const out: CatalogDomain[] = [];\n  for (const d of domains) {\n    if (seen.has(d.slug)) continue;\n    seen.add(d.slug);\n    out.push(d);\n  }\n  return out;\n}\n"]}
+{"version":3,"sources":["../cli/src/asset-feeds.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAqFA,SAAS,QAAQ,CAAA,EAAmB;AAClC,EAAA,OAAO,CAAA,CAAE,KAAA,CAAW,IAAA,CAAA,GAAG,CAAA,CAAE,KAAK,GAAG,CAAA;AACnC;AAGA,eAAe,cAAc,IAAA,EAAmC;AAC9D,EAAA,MAAM,MAAkB,EAAC;AACzB,EAAA,WAAA,MAAiB,EAAE,IAAA,EAAM,QAAA,EAAU,MAAK,IAAK,OAAA,CAAQ,IAAI,CAAA,EAAG;AAC1D,IAAA,IAAI,SAAS,kBAAA,EAAoB;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,EAAE,IAAA,EAAK,GAAI,iBAAiB,YAAA,CAAa,QAAA,EAAU,MAAM,CAAC,CAAA;AAChE,MAAA,GAAA,CAAI,IAAA,CAAK,cAAc,OAAA,CAAa,IAAA,CAAA,QAAA,CAAS,MAAM,QAAQ,CAAC,CAAA,EAAG,IAAI,CAAC,CAAA;AAAA,IACtE,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACX;AACA,EAAA,OAAO,GAAA;AACT;AAcA,eAAe,YAAA,CACb,IAAA,EACA,YAAA,EACA,OAAA,EACA,qBAAqB,IAAA,EACK;AAC1B,EAAA,MAAM,SAAA,GAAY,MAAM,aAAA,CAAc,IAAI,CAAA;AAC1C,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,GAAA,CAAI,CAAC,KAAA,MAAW;AAAA,IAC1C,KAAA;AAAA,IACA,KAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,CAAA,EAAI,MAAM,IAAI,CAAA,CAAA;AAAA,IAChC,cAAc,OAAA,CAAa,IAAA,CAAA,QAAA,CAAS,IAAA,EAAM,KAAA,CAAM,MAAM,CAAC;AAAA,GACzD,CAAE,CAAA;AAEF,EAAA,IAAI,YAAA,GAAe,KAAA;AACnB,EAAA,KAAA,MAAW,KAAK,WAAA,EAAa;AAC3B,IAAA,MAAM,IAAA,GAAO,YAAA,CAAa,CAAA,CAAE,YAAA,EAAc,SAAS,CAAA;AACnD,IAAA,IAAI,IAAA,EAAM,CAAA,CAAE,KAAA,CAAM,UAAA,GAAa,IAAA;AAAA,SAAA,IACtB,kBAAA,EAAoB;AAC3B,MAAA,CAAA,CAAE,MAAM,UAAA,GAAa,YAAA;AACrB,MAAA,YAAA,GAAe,IAAA;AAAA,IACjB,CAAA,MAAO,CAAA,CAAE,KAAA,CAAM,UAAA,GAAa,EAAA;AAAA,EAC9B;AAEA,EAAA,MAAM,EAAE,KAAA,EAAM,GAAI,gBAAA,CAAiB,aAAa,SAAS,CAAA;AACzD,EAAA,MAAM,UAA2B,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,IAChE,MAAM,CAAA,CAAE,IAAA;AAAA,IACR,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,GAAI,EAAE,WAAA,GAAc,EAAE,aAAa,CAAA,CAAE,WAAA,KAAgB,EAAC;AAAA,IACtD,GAAI,EAAE,QAAA,GAAW,EAAE,UAAU,CAAA,CAAE,QAAA,KAAa,EAAC;AAAA,IAC7C,GAAI,EAAE,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,IAClD,GAAI,CAAA,CAAE,WAAA,CAAY,CAAC,CAAA,GAAI,EAAE,cAAA,EAAgB,CAAA,CAAE,WAAA,CAAY,CAAC,CAAA,EAAE,GAAI;AAAC,GACjE,CAAE,CAAA;AACF,EAAA,IAAI,YAAA,UAAsB,IAAA,CAAK,EAAE,MAAM,YAAA,EAAc,KAAA,EAAO,cAAc,CAAA;AAC1E,EAAA,OAAO,OAAA;AACT;AAUA,eAAe,aAAA,GAIZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,MAAM,UAA2B,EAAC;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,CAAC,EAAE,kBAAA,EAAmB,EAAG,EAAE,aAAA,EAAc,EAAG,EAAE,iBAAA,EAAmB,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,MAC3F,OAAO,4BAAmB,CAAA;AAAA,MAC1B,OAAO,oBAA4B,CAAA;AAAA,MACnC,OAAO,iBAAyB;AAAA,KACjC,CAAA;AACD,IAAA,MAAM,EAAE,OAAA,EAAS,KAAA,EAAM,GAAI,MAAM,kBAAA,EAAmB;AACpD,IAAA,IAAI;AAIF,MAAA,MAAM,UAAU,iBAAA,EAAkB;AAClC,MAAA,MAAM,UAAA,GAAkB,IAAA,CAAA,IAAA,CAAK,aAAA,EAAc,EAAG,SAAS,CAAA;AACvD,MAAA,MAAM,IAAA,GAAA,CAAQ,MAAM,OAAA,CAAQ,aAAA,EAAc,EAAG,MAAA;AAAA,QAC3C,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA,IAAK,CAAC,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,UAAU;AAAA,OACrE;AACA,MAAA,MAAM,UAAyB,EAAC;AAChC,MAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,QAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,IAAI,CAAA,EAAG;AAI3B,QAAA,MAAM,UAAA,GAAa,CAAC,GAAI,MAAM,SAAS,GAAA,CAAI,IAAA,EAAM,GAAA,CAAI,IAAI,CAAE,CAAA;AAC3D,QAAA,OAAA,CAAQ,IAAA,CAAK,GAAI,MAAM,YAAA,CAAa,GAAA,CAAI,MAAM,GAAA,CAAI,IAAA,EAAM,UAAA,EAAY,KAAK,CAAE,CAAA;AAC3E,QAAA,KAAA,MAAW,KAAA,IAAS,UAAA,EAAY,OAAA,CAAQ,IAAA,CAAK,EAAE,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,MAC5F;AACA,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,IACnC,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,SAAS,KAAA,EAAM;AAAA,EACvC;AACF;AAYA,eAAe,YAAY,UAAA,EAIxB;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,oBAAA,EAAqB,GAAI,MAAM,OAAO,4BAAmB,CAAA;AACjE,IAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,MAAM,oBAAA,CAAqB,EAAE,YAAY,CAAA;AACnE,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,EAAW;AACvC,MAAA,MAAM,OAAA,GAA0B,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,QACjD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,IAAA,EAAO,EAAE,IAAA,IAAsB,OAAA;AAAA,QAC/B,WAAA,EAAa,EAAE,WAAA,IAAe,EAAA;AAAA,QAC9B,MAAA,EAAQ,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,CAAA;AAAA,QACvB,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,YAAY,CAAA,CAAE,UAAA;AAAA,QACd,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,UAAU,EAAC;AAAA,QACX,cAAc;AAAC,OACjB,CAAE,CAAA;AAIF,MAAA,MAAM,OAAA,GAAU,MAAM,WAAA,CAAY,MAAM,CAAA;AACxC,MAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,IACnC,CAAA,SAAE;AACA,MAAA,KAAA,EAAM;AAAA,IACR;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAM,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG3D,IAAA,IAAI,CAAC,QAAA,CAAS,IAAA,CAAK,GAAG,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,KAAK,CAAA;AAAA,IAC5C;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,IAAI,OAAA,EAAS,IAAI,KAAA,EAAM;AAAA,EAC3C;AACF;AAGA,eAAe,YAAY,MAAA,EAA2C;AACpE,EAAA,MAAM,KAAM,MAAA,CAA4D,WAAA;AACxE,EAAA,IAAI,OAAO,EAAA,KAAO,UAAA,EAAY,OAAO,EAAC;AACtC,EAAA,MAAM,OAAA,GAAU,MAAM,EAAA,CAAG,IAAA,CAAK,MAAM,CAAA;AACpC,EAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,GAAI,UAAU,EAAC;AAC7C;AAcA,eAAe,aACb,EAAA,EAC+D;AAI/D,EAAA,MAAM,eAAA,GAAkB,iBAAA,EAAkB,CAAE,GAAA,CAAI,CAAC,CAAA,KAAO,CAAA,CAAE,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,CAAA,GAAI,CAAA,GAAS,IAAA,CAAA,GAAI,CAAA;AAChG,EAAA,MAAM,gBAAgB,CAAC,CAAA,KACrB,eAAA,CAAgB,IAAA,CAAK,CAAC,EAAA,KAAO,CAAA,KAAM,EAAA,CAAG,KAAA,CAAM,GAAG,EAAE,CAAA,IAAK,CAAA,CAAE,UAAA,CAAW,EAAE,CAAC,CAAA;AAExE,EAAA,MAAM,GAAA,GAAA,CAAO,MAAM,EAAA,CAAG,MAAA,EAAO,EAAG,MAAA,CAAO,CAAC,CAAA,KAAM,CAAC,aAAA,CAAc,CAAA,CAAE,MAAM,CAAC,CAAA;AACtE,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,UAA2B,EAAC;AAMlC,EAAA,KAAA,MAAW,EAAE,QAAA,EAAU,IAAA,EAAK,IAAK,EAAA,CAAG,iBAAgB,EAAG;AACrD,IAAA,IAAI,aAAA,CAAc,IAAI,CAAA,EAAG;AACzB,IAAA,MAAM,SAAS,IAAA,CAAK,QAAA,CAAc,IAAA,CAAA,GAAG,CAAA,GAAI,OAAO,IAAA,GAAY,IAAA,CAAA,GAAA;AAC5D,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,MAAA,KAAW,IAAA,IAAQ,CAAA,CAAE,MAAA,CAAO,UAAA,CAAW,MAAM,CAAC,CAAA;AAChF,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACxB,IAAA,MAAM,aAAa,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,QAAA;AAGhD,IAAA,OAAA,CAAQ,IAAA,CAAK,GAAI,MAAM,YAAA,CAAa,MAAM,UAAA,EAAY,KAAA,EAAO,KAAK,CAAE,CAAA;AACpE,IAAA,KAAA,MAAW,KAAA,IAAS,KAAA,EAAO,OAAA,CAAQ,IAAA,CAAK,EAAE,QAAQ,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,CAAA;AAAA,EACxF;AACA,EAAA,OAAO,EAAE,SAAS,OAAA,EAAQ;AAC5B;AAUA,eAAe,aAAA,GAIZ;AACD,EAAA,MAAM,QAAoB,EAAC;AAC3B,EAAA,MAAM,UAA2B,EAAC;AAClC,EAAA,IAAI;AACF,IAAA,MAAM,UAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,IAAA,IAAQ,mBAAkB,EAAG;AACtC,MAAA,MAAM,cAAc,CAAC,GAAI,MAAM,QAAA,CAAS,IAAA,EAAM,gBAAgB,CAAE,CAAA;AAChE,MAAA,OAAA,CAAQ,KAAK,GAAI,MAAM,aAAa,IAAA,EAAM,gBAAA,EAAkB,WAAW,CAAE,CAAA;AACzE,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,WAAW,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAM;AAAA,EACnC,SAAS,GAAA,EAAK;AACZ,IAAA,KAAA,CAAM,IAAA,CAAK;AAAA,MACT,IAAA,EAAM,SAAA;AAAA,MACN,SAAS,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG;AAAA,KACzD,CAAA;AACD,IAAA,OAAO,EAAE,OAAA,EAAS,EAAC,EAAG,SAAS,KAAA,EAAM;AAAA,EACvC;AACF;AAGA,SAAS,GAAA,CAAI,QAAqB,OAAA,EAAwC;AACxE,EAAA,OAAO,QAAQ,GAAA,CAAI,CAAC,WAAW,EAAE,MAAA,EAAQ,OAAM,CAAE,CAAA;AACnD;AASA,eAAsB,gBAAA,CACpB,IACA,UAAA,EAC0B;AAC1B,EAAA,MAAM,CAAC,IAAA,EAAM,KAAK,CAAA,GAAI,MAAM,OAAA,CAAQ,GAAA,CAAI,CAAC,aAAA,EAAc,EAAG,WAAA,CAAY,UAAU,CAAC,CAAC,CAAA;AAClF,EAAA,MAAM,OAAA,GAAU,MAAM,aAAA,EAAc;AACpC,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,CAAa,EAAE,CAAA;AACjC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS;AAAA,MACP,GAAG,GAAA,CAAI,OAAA;AAAA,MACP,GAAG,IAAA,CAAK,OAAA;AAAA,MACR,GAAG,GAAA,CAAI,SAAA,EAAW,OAAA,CAAQ,OAAO,CAAA;AAAA,MACjC,GAAG,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,OAAO;AAAA,KAC/B;AAAA;AAAA;AAAA,IAGA,OAAA,EAAS,YAAA,CAAa,CAAC,GAAG,MAAM,OAAA,EAAS,GAAG,GAAA,CAAI,OAAA,EAAS,GAAG,IAAA,CAAK,OAAA,EAAS,GAAG,OAAA,CAAQ,OAAO,CAAC,CAAA;AAAA,IAC7F,KAAA,EAAO,CAAC,GAAG,IAAA,CAAK,KAAA,EAAO,GAAG,KAAA,CAAM,KAAA,EAAO,GAAG,OAAA,CAAQ,KAAK;AAAA,GACzD;AACF;AAGA,SAAS,aAAa,OAAA,EAA2C;AAC/D,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAA,EAAG;AACtB,IAAA,IAAA,CAAK,GAAA,CAAI,EAAE,IAAI,CAAA;AACf,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,OAAO,GAAA;AACT","file":"asset-feeds-OO3NIRVI.js","sourcesContent":["/**\n * asset-feeds.ts — gather installable assets from every feed the manage TUI\n * surfaces.\n *\n * Four feeds, normalized into `CatalogEntry`:\n * - **Project sources** — `skaile.yaml` `sources:` entries (scanned via\n *   `AssetManager.search()`; the new `sources:` field is merged into the\n *   legacy repositories map in `AssetManager.loadConfig`).\n * - **Local libraries** — user authoring places from `LocalIndex` (filesystem\n *   scan of each library's `path`).\n * - **Factory assets** — the bundled first-party `factory-assets` tree\n *   (`factoryAssetRoots()`), scanned from disk. Always present; no network.\n * - **Remote store** — the configured catalog source when `catalog.url` is\n *   not `local`. Failures are non-fatal — they surface as notes.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport {\n  type AssetKind,\n  type CatalogDomain,\n  type CatalogEntry,\n  factoryAssetRoots,\n  parseFrontmatter,\n  scanRepo,\n  walkDir,\n} from \"@skaile/workspaces/core\";\nimport {\n  assignDomain,\n  buildDomainIndex,\n  DOMAIN_MD_FILENAME,\n  type DomainMd,\n  parseDomainMd,\n} from \"@skaile/workspaces/discovery\";\n\n/** One non-fatal note returned to the caller for surfacing in the UI. */\nexport interface FeedNote {\n  feed: \"sources\" | \"libraries\" | \"store\" | \"factory\";\n  message: string;\n}\n\n/**\n * Which feed an asset came from. This is the top-level grouping axis in the\n * manage TUI (\"where is this skill coming from?\") and is intentionally distinct\n * from `publisher` (asset-intrinsic identity): the same publisher can legitimately\n * appear under more than one origin (e.g. a github repo you added as a `source`\n * that is also listed in the remote `store`).\n */\nexport type AssetOrigin = \"source\" | \"library\" | \"factory\" | \"store\";\n\n/** A catalog entry tagged with the feed it was gathered from. */\nexport interface OriginEntry {\n  origin: AssetOrigin;\n  entry: CatalogEntry;\n  /**\n   * Second-level grouping label for the manage tree. Defaults (when unset) to the\n   * entry's `publisher`; the source feed sets it to the source's short repo name\n   * so the Sources band groups by source — \"which repo did this come from\" — not\n   * by the asset-intrinsic publisher.\n   */\n  group?: string;\n}\n\nexport interface AssetFeedResult {\n  entries: OriginEntry[];\n  /**\n   * Display-only domain metadata, keyed (by the consumer) on `slug`. Populated\n   * from the store's `catalog.listDomains` when the connected catalog source\n   * exposes it; empty otherwise. The manage TUI joins `entry.domainSlug` → a\n   * domain for grouping headers, descriptions, and relation badges.\n   */\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}\n\n// ── Domain stamping (on-disk feeds) ──────────────────────────────────────────\n//\n// `scanRepo` (the source / library / factory scan path) does not read the\n// `DOMAIN.md` sidecars, so its entries arrive with no `domainSlug` and render\n// flat under their publisher band. We re-derive the grouping here from the\n// root's `DOMAIN.md` files (the same sidecars the remote store computes\n// server-side), and fall back to the repo/source name for any entry no domain\n// claims so it still groups instead of landing in the synthetic \"no domain\" pile.\n\n/** Repo-relative POSIX path (DOMAIN.md slugs are matched whole-segment, `/`-joined). */\nfunction toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** Parse every `DOMAIN.md` sidecar under `root` into a {@link DomainMd}. */\nasync function loadDomainMds(root: string): Promise<DomainMd[]> {\n  const out: DomainMd[] = [];\n  for await (const { path: filePath, name } of walkDir(root)) {\n    if (name !== DOMAIN_MD_FILENAME) continue;\n    try {\n      const { data } = parseFrontmatter(readFileSync(filePath, \"utf8\"));\n      out.push(parseDomainMd(toPosix(path.relative(root, filePath)), data));\n    } catch {}\n  }\n  return out;\n}\n\n/**\n * Stamp `domainSlug` onto every entry scanned from `root` using the root's\n * `DOMAIN.md` sidecars. Returns the `CatalogDomain` registry for the real\n * domains, plus a synthetic fallback domain when any entry used the fallback.\n * Mutates `entries` in place (sets `entry.domainSlug`).\n *\n * `synthesizeFallback` (default true): entries no domain claims fall back to\n * `fallbackSlug` (the repo/source name). Pass `false` when the caller already\n * groups these entries one level up (e.g. the source feed groups by source\n * node) — unmatched entries then get no domain (`\"\"`) and hang directly under\n * that parent, instead of nesting under a same-named fallback domain.\n */\nasync function stampDomains(\n  root: string,\n  fallbackSlug: string,\n  entries: CatalogEntry[],\n  synthesizeFallback = true,\n): Promise<CatalogDomain[]> {\n  const domainMds = await loadDomainMds(root);\n  const assignables = entries.map((entry) => ({\n    entry,\n    ref: `${entry.kind}:${entry.name}`,\n    relativePath: toPosix(path.relative(root, entry.source)),\n  }));\n\n  let usedFallback = false;\n  for (const a of assignables) {\n    const slug = assignDomain(a.relativePath, domainMds);\n    if (slug) a.entry.domainSlug = slug;\n    else if (synthesizeFallback) {\n      a.entry.domainSlug = fallbackSlug;\n      usedFallback = true;\n    } else a.entry.domainSlug = \"\";\n  }\n\n  const { index } = buildDomainIndex(assignables, domainMds);\n  const catalog: CatalogDomain[] = Object.values(index).map((d) => ({\n    slug: d.slug,\n    title: d.title,\n    ...(d.description ? { description: d.description } : {}),\n    ...(d.relation ? { relation: d.relation } : {}),\n    ...(d.order !== undefined ? { order: d.order } : {}),\n    ...(d.recommended[0] ? { recommendedRef: d.recommended[0] } : {}),\n  }));\n  if (usedFallback) catalog.push({ slug: fallbackSlug, title: fallbackSlug });\n  return catalog;\n}\n\n/**\n * Pull assets from local libraries (the authoring places under\n * `~/.skaile/libraries/<name>/`, not the `~/.skaile/cache/sources/` cache). Each\n * library's `path` is scanned with `scanRepo` and grouped under the bare library\n * name (`group: <name>`) so the manage TUI shows a clean `<name>` band — no\n * `library:` prefix and no redundant same-named fallback domain (mirrors the\n * source feed).\n */\nasync function libraryAssets(): Promise<{\n  entries: OriginEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  const domains: CatalogDomain[] = [];\n  try {\n    const [{ openLibraryManager }, { skaileHomeDir }, { getGlobalCacheDir }] = await Promise.all([\n      import(\"./open-library.ts\"),\n      import(\"@skaile/workspaces/library\"),\n      import(\"@skaile/workspaces/core\"),\n    ]);\n    const { manager, close } = await openLibraryManager();\n    try {\n      // Authoring libraries are the rows that are NOT source clones. index.db\n      // rows predating the cache migration still carry the legacy\n      // ~/.skaile/sources path, so exclude both roots.\n      const newRoot = getGlobalCacheDir();\n      const legacyRoot = path.join(skaileHomeDir(), \"sources\");\n      const libs = (await manager.listLibraries()).filter(\n        (l) => !l.path.startsWith(newRoot) && !l.path.startsWith(legacyRoot),\n      );\n      const entries: OriginEntry[] = [];\n      for (const lib of libs) {\n        if (!existsSync(lib.path)) continue;\n        // Scan + group under the bare library name. `synthesizeFallback: false`\n        // (as the source feed does) keeps domainless assets directly under the\n        // library band instead of a redundant same-named fallback domain.\n        const libEntries = [...(await scanRepo(lib.path, lib.name))];\n        domains.push(...(await stampDomains(lib.path, lib.name, libEntries, false)));\n        for (const entry of libEntries) entries.push({ origin: \"library\", entry, group: lib.name });\n      }\n      return { entries, domains, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    notes.push({\n      feed: \"libraries\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], domains, notes };\n  }\n}\n\n/**\n * Pull a (best-effort) snapshot of the connected remote store catalog.\n *\n * - Returns no entries when the resolved catalog is local-only or the host\n *   is unreachable (the failure becomes a note, not an exception).\n * - Maps `CatalogAsset` → `CatalogEntry`, carrying `publisher`, `repo`, and\n *   `category` straight through and using `source = \"store://<id>\"`; per-file\n *   `source` paths are not available for remote assets so the canonical ref is\n *   a stable placeholder.\n */\nasync function storeAssets(projectDir: string): Promise<{\n  entries: CatalogEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  try {\n    const { resolveCatalogSource } = await import(\"./open-library.ts\");\n    const { source, close } = await resolveCatalogSource({ projectDir });\n    try {\n      const assets = await source.listAssets();\n      const entries: CatalogEntry[] = assets.map((a) => ({\n        name: a.name,\n        kind: (a.kind as AssetKind) ?? \"skill\",\n        description: a.description ?? \"\",\n        source: `store://${a.id}`,\n        publisher: a.publisher,\n        repo: a.repo,\n        domainSlug: a.domainSlug,\n        category: a.category,\n        version: a.version,\n        requires: [],\n        dependencies: [],\n      }));\n      // Domains are optional on the catalog source — only the store backend\n      // (post Part 4 `catalog.listDomains`) exposes them. Duck-type the call so\n      // older sources and the local catalog degrade to no domains, not an error.\n      const domains = await loadDomains(source);\n      return { entries, domains, notes };\n    } finally {\n      close();\n    }\n  } catch (err) {\n    const msg = err instanceof Error ? err.message : String(err);\n    // Local-only catalog throws a recognizable message — silence it; absence\n    // is the user's choice, not an error.\n    if (!/local/i.test(msg)) {\n      notes.push({ feed: \"store\", message: msg });\n    }\n    return { entries: [], domains: [], notes };\n  }\n}\n\n/** Optional `listDomains` capability — returns `[]` when the source lacks it. */\nasync function loadDomains(source: unknown): Promise<CatalogDomain[]> {\n  const fn = (source as { listDomains?: () => Promise<CatalogDomain[]> }).listDomains;\n  if (typeof fn !== \"function\") return [];\n  const domains = await fn.call(source);\n  return Array.isArray(domains) ? domains : [];\n}\n\n/** The slice of `AssetManager` the source feed needs (kept narrow for tests). */\ninterface AssetManagerLike {\n  search: () => Promise<CatalogEntry[]>;\n  searchRepoRoots: () => { repoName: string; root: string }[];\n}\n\n/**\n * Project-source feed: leans on `AssetManager.search()`, which now merges\n * `skaile.yaml`'s `sources:` field into the repositories map, then stamps\n * `DOMAIN.md`-derived domain grouping onto the scanned entries via\n * `searchRepoRoots()`.\n */\nasync function sourceAssets(\n  am: AssetManagerLike,\n): Promise<{ entries: OriginEntry[]; domains: CatalogDomain[] }> {\n  // The bundled factory tree is injected into the repositories map as an implicit\n  // source, so `am.search()` returns it too. It has its own `factory` origin band,\n  // so drop it here — otherwise the same first-party skills list twice under Sources.\n  const factoryPrefixes = factoryAssetRoots().map((r) => (r.endsWith(path.sep) ? r : r + path.sep));\n  const isFactoryPath = (p: string) =>\n    factoryPrefixes.some((fp) => p === fp.slice(0, -1) || p.startsWith(fp));\n\n  const all = (await am.search()).filter((e) => !isFactoryPath(e.source));\n  const entries: OriginEntry[] = [];\n  const domains: CatalogDomain[] = [];\n  // Group each source's entries under the source node (its short repo name), not\n  // the publisher: under Sources the navigational question is \"which repo did\n  // this come from\". Each entry's `source` (absolute manifest path) lives under\n  // exactly one declared root, so group + stamp by prefix. The cache slug is\n  // URL-keyed `github.com/<org>/<repo>` — take the trailing segment.\n  for (const { repoName, root } of am.searchRepoRoots()) {\n    if (isFactoryPath(root)) continue;\n    const prefix = root.endsWith(path.sep) ? root : root + path.sep;\n    const owned = all.filter((e) => e.source === root || e.source.startsWith(prefix));\n    if (owned.length === 0) continue;\n    const sourceName = repoName.split(\"/\").pop() || repoName;\n    // No synthetic fallback domain — the source node already groups these, so a\n    // same-named fallback would just nest the source under itself.\n    domains.push(...(await stampDomains(root, sourceName, owned, false)));\n    for (const entry of owned) entries.push({ origin: \"source\", entry, group: sourceName });\n  }\n  return { entries, domains };\n}\n\n/**\n * Factory-asset feed: scan the bundled first-party `factory-assets` tree(s)\n * resolved by `factoryAssetRoots()` (the `SKAILE_FACTORY_ASSETS_DIR` override\n * layer ahead of the bundled tree). Local disk only, no network — the entries are\n * the built-in skills / connectors / bundles that ship with `@skaile/workspaces`.\n * `factoryAssetRoots()` already dedupes, so the env override pointing at the\n * bundled dir collapses to one root.\n */\nasync function factoryAssets(): Promise<{\n  entries: CatalogEntry[];\n  domains: CatalogDomain[];\n  notes: FeedNote[];\n}> {\n  const notes: FeedNote[] = [];\n  const domains: CatalogDomain[] = [];\n  try {\n    const entries: CatalogEntry[] = [];\n    for (const root of factoryAssetRoots()) {\n      const rootEntries = [...(await scanRepo(root, \"skaile-factory\"))];\n      domains.push(...(await stampDomains(root, \"skaile-factory\", rootEntries)));\n      entries.push(...rootEntries);\n    }\n    return { entries, domains, notes };\n  } catch (err) {\n    notes.push({\n      feed: \"factory\",\n      message: err instanceof Error ? err.message : String(err),\n    });\n    return { entries: [], domains, notes };\n  }\n}\n\n/** Tag a flat entry list with a single origin. */\nfunction tag(origin: AssetOrigin, entries: CatalogEntry[]): OriginEntry[] {\n  return entries.map((entry) => ({ origin, entry }));\n}\n\n/**\n * Run all feeds and return a single normalized result.\n *\n * Feeds run in parallel where possible — the store fetch is the slow one\n * (one HTTP call) and is fired alongside the local library walk. The factory\n * scan is local disk only, so it runs inline.\n */\nexport async function gatherAssetFeeds(\n  am: AssetManagerLike,\n  projectDir: string,\n): Promise<AssetFeedResult> {\n  const [libs, store] = await Promise.all([libraryAssets(), storeAssets(projectDir)]);\n  const factory = await factoryAssets();\n  const src = await sourceAssets(am);\n  return {\n    entries: [\n      ...src.entries,\n      ...libs.entries,\n      ...tag(\"factory\", factory.entries),\n      ...tag(\"store\", store.entries),\n    ],\n    // Store domains first (server-curated), then the on-disk feeds; dedupe by\n    // slug, first-wins, so a store-served domain shadows a same-slug local one.\n    domains: dedupeBySlug([...store.domains, ...src.domains, ...libs.domains, ...factory.domains]),\n    notes: [...libs.notes, ...store.notes, ...factory.notes],\n  };\n}\n\n/** First-wins dedupe of a domain list by `slug`. */\nfunction dedupeBySlug(domains: CatalogDomain[]): CatalogDomain[] {\n  const seen = new Set<string>();\n  const out: CatalogDomain[] = [];\n  for (const d of domains) {\n    if (seen.has(d.slug)) continue;\n    seen.add(d.slug);\n    out.push(d);\n  }\n  return out;\n}\n"]}

package/dist/asset-manager/index.js

@@ -1,4 +1,4 @@
-export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, NON_DEPLOYABLE_KINDS, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName } from '../chunk-67KB2A77.js';
+export { AssetManager, FACTORY_SOURCE_URL, MissingManifestError, NON_DEPLOYABLE_KINDS, normalizeRepoUrl, parseCanonicalLockKey, parseRefTolerant, renderMcpServerConfig, softDepName } from '../chunk-YLSMYOHN.js';
 import '../chunk-QG2ZXU5W.js';
 import '../chunk-DZ4UZOFB.js';
 import '../chunk-UKJMQZV6.js';

package/dist/bridge/codex-app-server.js

@@ -1,4 +1,4 @@
-export { CodexAppServerClient, CodexAppServerError } from '../chunk-XKSGEYZC.js';
+export { CodexAppServerClient, CodexAppServerError } from '../chunk-PHBYB4XT.js';
 import '../chunk-LOO5CB5M.js';
 import '../chunk-NSBPE2FW.js';
 //# sourceMappingURL=codex-app-server.js.map

package/dist/bridge/drivers/claude-sdk.js

@@ -2,7 +2,7 @@ import { scrubPoisonedTranscript, resolveClaudeConfigDir, SUPPORTED_CLOUDS, buil
 import { dispatchCapability } from '../../chunk-7ZO3MUP3.js';
 import { fetchProviderModels } from '../../chunk-GURXUF2J.js';
 import { AuthError, classifyClaudeSdkError, reclassifyAuthAsAccountUnavailable, AccountUnavailableError } from '../../chunk-GAH4YRCI.js';
-import { BUILTIN_DRIVER_CATALOG, AgentDriver, getBridgeLogger } from '../../chunk-J7VSUGGH.js';
+import { BUILTIN_DRIVER_CATALOG, AgentDriver, getBridgeLogger } from '../../chunk-KB2GC6YY.js';
 import '../../chunk-6E6PKKAD.js';
 import '../../chunk-H662SXKS.js';
 import '../../chunk-F3HNW354.js';

package/dist/bridge/drivers/codex.js

@@ -1,14 +1,15 @@
-import { CodexAppServerClient } from '../../chunk-XKSGEYZC.js';
-import { parseCodexCredential, prepareNativePolicy, prepareCodexInstance, codexInstanceEnvironment, activateNativeApprovalPolicy, parseCodexRefreshResult, isNativeApprovalPolicyActive, allowsNativeApprovalPath } from '../../chunk-T3YLZQS4.js';
+import { CodexAppServerClient } from '../../chunk-PHBYB4XT.js';
+import { parseCodexCredential, prepareNativePolicy, prepareCodexInstance, codexInstanceEnvironment, isNativeApprovalPolicyActive, activateNativeApprovalPolicy, parseCodexRefreshResult, allowsNativeApprovalPath } from '../../chunk-T3YLZQS4.js';
 import { CodexNativeStateUnavailable } from '../../chunk-LOO5CB5M.js';
 import { fetchProviderModels } from '../../chunk-GURXUF2J.js';
 import { classifyGenericErrorMessage } from '../../chunk-GAH4YRCI.js';
-import { BUILTIN_DRIVER_CATALOG, AgentDriver, getBridgeLogger } from '../../chunk-J7VSUGGH.js';
+import { BUILTIN_DRIVER_CATALOG, AgentDriver, getBridgeLogger } from '../../chunk-KB2GC6YY.js';
 import '../../chunk-6E6PKKAD.js';
 import '../../chunk-FTG7CRFD.js';
 import '../../chunk-W4IPN3DD.js';
 import '../../chunk-NSBPE2FW.js';
 import { join, dirname, isAbsolute, relative } from 'path';
+import { isDeepStrictEqual } from 'util';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, realpathSync, statSync } from 'fs';
 import { randomUUID } from 'crypto';
 import * as z from 'zod';
@@ -54,8 +55,8 @@ function codexPromptInput(input, cwd, skills) {
 // bridge/src/codex/native-approvals.ts
 function createCodexNativeApprovalHandlers(options) {
   const active = (signal, threadId) => !signal.aborted && isNativeApprovalPolicyActive(options.getPolicy(), threadId);
-  const text = (value) => typeof value === "string" && value.length > 0 && value.length <= 8192;
-  const scoped = async (path, access, signal, threadId) => active(signal, threadId) && text(path) && allowsNativeApprovalPath(options.getPolicy(), path, access) && active(signal, threadId);
+  const text2 = (value) => typeof value === "string" && value.length > 0 && value.length <= 8192;
+  const scoped = async (path, access, signal, threadId) => active(signal, threadId) && text2(path) && allowsNativeApprovalPath(options.getPolicy(), path, access) && active(signal, threadId);
   const permissions = async (value, signal, threadId) => {
     if (value.network?.enabled || value.network != null && Object.keys(value.network).some((key) => key !== "enabled") || Object.keys(value).some((key) => !["network", "fileSystem"].includes(key)))
       return false;
@@ -83,7 +84,7 @@ function createCodexNativeApprovalHandlers(options) {
   return {
     "item/commandExecution/requestApproval": async (input, signal) => {
       const params = structuredClone(input);
-      const allowed = async () => active(signal, params.threadId) && text(params.command) && (params.kind == null || params.kind === "command") && !params.environmentId && !params.networkApprovalContext && (params.availableDecisions == null || params.availableDecisions.includes("accept")) && await scoped(params.cwd, "read", signal, params.threadId) && (!params.additionalPermissions || await permissions(params.additionalPermissions, signal, params.threadId));
+      const allowed = async () => active(signal, params.threadId) && text2(params.command) && (params.kind == null || params.kind === "command") && !params.environmentId && !params.networkApprovalContext && (params.availableDecisions == null || params.availableDecisions.includes("accept")) && await scoped(params.cwd, "read", signal, params.threadId) && (!params.additionalPermissions || await permissions(params.additionalPermissions, signal, params.threadId));
       if (!await allowed()) return { decision: "decline" };
       const details = [`Command: ${params.command}`, `Directory: ${params.cwd}`];
       for (const access of ["read", "write"])
@@ -105,7 +106,7 @@ function createCodexNativeApprovalHandlers(options) {
         if (params.grantRoot != null && !await scoped(params.grantRoot, "write", signal, params.threadId))
           return false;
         for (const change of changes) {
-          if (!text(change.diff) || !await scoped(change.path, "write", signal, params.threadId))
+          if (!text2(change.diff) || !await scoped(change.path, "write", signal, params.threadId))
             return false;
           if (!["add", "delete", "update"].includes(change.kind.type)) return false;
           if (change.kind.type === "update" && change.kind.move_path != null && !await scoped(change.kind.move_path, "write", signal, params.threadId))
@@ -138,6 +139,48 @@ function createCodexNativeApprovalHandlers(options) {
     }
   };
 }
+
+// bridge/src/codex/native-mcp-approval.ts
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var text = (value) => typeof value === "string" && value.length > 0 && Buffer.byteLength(value) <= 8192;
+function createCodexMcpApprovalHandler(options) {
+  return async (input, signal) => {
+    const decline = { action: "decline", content: null, _meta: null };
+    try {
+      const params = structuredClone(input);
+      const active = () => !signal.aborted && options.bindingActive() && isNativeApprovalPolicyActive(options.getPolicy(), params.threadId);
+      if (!active() || !text(options.serverName) || params.serverName !== options.serverName || !text(params.threadId) || !text(params.turnId) || params.mode !== "form" || !text(params.message) || Object.keys(params).some(
+        (key) => ![
+          "threadId",
+          "turnId",
+          "serverName",
+          "mode",
+          "message",
+          "requestedSchema",
+          "_meta"
+        ].includes(key)
+      ) || !record(params._meta) || params._meta.codex_approval_kind !== "mcp_tool_call" || !record(params.requestedSchema) || params.requestedSchema.type !== "object" || !record(params.requestedSchema.properties) || Object.keys(params.requestedSchema.properties).length !== 0 || Object.keys(params.requestedSchema).some(
+        (key) => !["type", "properties", "required"].includes(key)
+      ) || params.requestedSchema.required !== void 0 && (!Array.isArray(params.requestedSchema.required) || params.requestedSchema.required.length !== 0) || Buffer.byteLength(JSON.stringify(params._meta)) > 65536)
+        return decline;
+      const accepted = await options.questions.requestApproval(
+        void 0,
+        {
+          kind: "mcp",
+          details: [
+            `Configured MCP server: ${options.serverName}`,
+            params.message,
+            "This is native request presentation, not an independently verified tool identity. Tool permissions are checked again when dispatched."
+          ]
+        },
+        signal
+      );
+      return accepted && active() ? { action: "accept", content: null, _meta: null } : decline;
+    } catch {
+      return decline;
+    }
+  };
+}
 var CodexQuestions = class {
   constructor(emit) {
     this.emit = emit;
@@ -145,7 +188,7 @@ var CodexQuestions = class {
   emit;
   pending;
   request = async (params, signal) => this.park(params, signal);
-  /** Park one explicit native consent request in the same slot as ordinary questions. */
+  /** Park native consent; MCP uses only local correlation because it supplies no native item ID. */
   async requestApproval(identity, approval, signal) {
     const result = await this.park(
       {
@@ -155,7 +198,7 @@ var CodexQuestions = class {
           {
             id: "native-approval",
             header: "Approval",
-            question: approval.kind === "permissions" ? "Allow these permissions for the current turn?" : "Allow this native action once?",
+            question: approval.kind === "permissions" ? "Allow these permissions for the current turn?" : approval.kind === "mcp" ? "Allow this native MCP request once?" : "Allow this native action once?",
             options: [
               {
                 label: "Approve once",
@@ -175,7 +218,10 @@ var CodexQuestions = class {
     signal.throwIfAborted();
     if (this.pending || !params.isBlocking || !Array.isArray(params.questions) || params.questions.length === 0 || params.questions.length > 16 || params.questions.some((q) => !q.id || !q.question || q.isSecret) || new Set(params.questions.map((q) => q.id)).size !== params.questions.length || new Set(params.questions.map((q) => q.question)).size !== params.questions.length)
       throw new Error("CODEX_INPUT_UNSUPPORTED");
+    params = structuredClone(params);
+    approval = approval ? structuredClone(approval) : void 0;
     const id = randomUUID();
+    const eventId = params.itemId ?? `local-consent:${id}`;
     return new Promise((resolve, reject) => {
       const abort = () => finish();
       const finish = (result) => {
@@ -194,8 +240,8 @@ var CodexQuestions = class {
       };
       const input = {
         requestId: id,
-        questions: params.questions,
-        ...approval ? { approval } : {}
+        questions: structuredClone(params.questions),
+        ...approval ? { approval: structuredClone(approval) } : {}
       };
       signal.addEventListener("abort", abort, { once: true });
       if (signal.aborted) {
@@ -210,17 +256,18 @@ var CodexQuestions = class {
             {
               type: "tool_use",
               name: "AskUserQuestion",
-              id: params.itemId,
+              id: eventId,
               input
             }
           ]
         }
       });
+      if (this.pending?.id !== id || signal.aborted) return;
       this.emit({
         type: "tool_call",
         name: "AskUserQuestion",
         tool: { name: "AskUserQuestion" },
-        toolCallId: params.itemId,
+        toolCallId: eventId,
         input
       });
     });
@@ -243,7 +290,7 @@ var CodexQuestions = class {
 };
 
 // bridge/src/codex/managed-driver.ts
-var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var record2 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 var failure = (code = "CODEX_RUNTIME_UNSUPPORTED") => new Error(code);
 var nativeUsage = (value) => ({
   ...typeof value.inputTokens === "number" ? { inputTokens: value.inputTokens } : {},
@@ -415,6 +462,7 @@ var ManagedCodexDriver = class extends AgentDriver {
     });
     this.instance = prepareCodexInstance(this.config, options, this.credential);
     const generation = ++this.generation;
+    const mcpReplies = /* @__PURE__ */ new WeakMap();
     this.controller = new AbortController();
     this.startupRefreshUsed = false;
     this.startupAuthAttempted = false;
@@ -475,6 +523,10 @@ var ManagedCodexDriver = class extends AgentDriver {
         requestTimeoutMs: timeout,
         serverRequestTimeoutMs: Math.min(limit(options.interactionTimeoutMs, 3e5), 3e5),
         onServerRequest: handlers,
+        canReplyToServerRequest: (method, params) => {
+          if (method !== "mcpServer/elicitation/request") return true;
+          return record2(params) && (mcpReplies.get(params)?.() ?? false);
+        },
         onNotification: (method, params) => {
           if (generation === this.generation) this.notification(method, params);
         },
@@ -510,7 +562,7 @@ var ManagedCodexDriver = class extends AgentDriver {
     } catch {
       throw failure("CODEX_REQUIRED_TOOL_UNAVAILABLE");
     }
-    if (!this.tools || !record(this.tools.mcpServers) || typeof this.tools.dispose !== "function" || Object.keys(this.tools.mcpServers).length === 0 && Object.keys(this.tools.onServerRequest ?? {}).length === 0)
+    if (!this.tools || !record2(this.tools.mcpServers) || typeof this.tools.dispose !== "function" || Object.keys(this.tools.mcpServers).length === 0 && Object.keys(this.tools.onServerRequest ?? {}).length === 0)
       throw failure("CODEX_REQUIRED_TOOL_UNAVAILABLE");
     if (this.tools.onServerRequest?.["item/tool/requestUserInput"])
       throw failure("AI_PROFILE_INVALID");
@@ -525,21 +577,40 @@ var ManagedCodexDriver = class extends AgentDriver {
         return snapshot ? JSON.parse(snapshot) : void 0;
       }
     });
+    const approvalTools = this.tools;
+    const approvalServerName = approvalTools.approvalServerName;
+    const approvalServer = approvalServerName ? approvalTools.mcpServers[approvalServerName] : void 0;
+    const approvalServerSnapshot = structuredClone(approvalServer);
+    const mcpBindingActive = () => this.tools === approvalTools && approvalTools.approvalServerName === approvalServerName && Boolean(approvalServerName) && Object.hasOwn(approvalTools.mcpServers, approvalServerName) && record2(approvalServer) && approvalTools.mcpServers[approvalServerName] === approvalServer && isDeepStrictEqual(approvalServer, approvalServerSnapshot);
+    const mcpPolicy = () => tuning.approvalPolicy === "never" ? void 0 : this.nativeApprovalPolicy;
+    const mcpApproval = createCodexMcpApprovalHandler({
+      serverName: approvalServerName,
+      questions: this.questions,
+      getPolicy: mcpPolicy,
+      bindingActive: mcpBindingActive
+    });
     for (const [method, handler] of Object.entries({
       ...this.tools.onServerRequest,
       ...nativeApprovals,
-      "item/tool/requestUserInput": this.questions.request
+      "item/tool/requestUserInput": this.questions.request,
+      "mcpServer/elicitation/request": mcpApproval
     })) {
       if (method === "account/chatgptAuthTokens/refresh" || !handler)
         throw failure("AI_PROFILE_INVALID");
       handlers[method] = async (params, signal) => {
         const active = this.active;
-        if (generation !== this.generation || !active || !record(params)) throw failure();
+        if (generation !== this.generation || !active || !record2(params)) throw failure();
         await active.ready;
         if (generation !== this.generation || this.active !== active || params.threadId !== this.threadId || params.turnId !== active.id)
           throw failure();
         const cancellation = AbortSignal.any([signal, active.controller.signal]);
         if (cancellation.aborted) throw failure();
+        if (method === "mcpServer/elicitation/request") {
+          mcpReplies.set(
+            params,
+            () => generation === this.generation && this.active === active && !cancellation.aborted && params.threadId === this.threadId && params.turnId === active.id && mcpBindingActive() && isNativeApprovalPolicyActive(mcpPolicy(), this.threadId ?? "")
+          );
+        }
         const result = await handler(params, cancellation);
         if (generation !== this.generation || cancellation.aborted || this.active !== active)
           throw failure();
@@ -571,14 +642,14 @@ var ManagedCodexDriver = class extends AgentDriver {
       ...threadParams,
       allowProviderModelFallback: false
     });
-    if (!record(response) || response.model !== this.config.model)
+    if (!record2(response) || response.model !== this.config.model)
       throw failure("CODEX_MODEL_UNAVAILABLE");
-    if (!record(response.thread) || typeof response.thread.id !== "string" || resuming && response.thread.id !== this.config.resumeSessionId || resuming && !Array.isArray(response.thread.turns) || response.reasoningEffort !== (this.config.effort ?? tuning.reasoningEffort) || response.modelProvider !== "openai" || response.approvalPolicy !== tuning.approvalPolicy)
+    if (!record2(response.thread) || typeof response.thread.id !== "string" || resuming && response.thread.id !== this.config.resumeSessionId || resuming && !Array.isArray(response.thread.turns) || response.reasoningEffort !== (this.config.effort ?? tuning.reasoningEffort) || response.modelProvider !== "openai" || response.approvalPolicy !== tuning.approvalPolicy)
       throw failure("AI_PROFILE_INVALID");
     if (generation !== this.generation || this.killed) throw failure();
     this.resumeUsageTurnIds = new Set(
       resuming && Array.isArray(response.thread.turns) ? response.thread.turns.flatMap(
-        (turn) => record(turn) && typeof turn.id === "string" ? [turn.id] : []
+        (turn) => record2(turn) && typeof turn.id === "string" ? [turn.id] : []
       ) : []
     );
     this.nativeApprovalPolicy = activateNativeApprovalPolicy(
@@ -623,7 +694,7 @@ var ManagedCodexDriver = class extends AgentDriver {
   }
   async refresh(params, signal) {
     const credential = this.credential;
-    if (!record(params) || params.reason !== "unauthorized" || !credential || credential.kind !== "codex-subscription" || params.previousAccountId != null && params.previousAccountId !== credential.chatgptAccountId || !this.options?.refreshCredential || (this.active ? this.active.refreshUsed : this.startupRefreshUsed))
+    if (!record2(params) || params.reason !== "unauthorized" || !credential || credential.kind !== "codex-subscription" || params.previousAccountId != null && params.previousAccountId !== credential.chatgptAccountId || !this.options?.refreshCredential || (this.active ? this.active.refreshUsed : this.startupRefreshUsed))
       throw failure("CODEX_AUTH_UNAVAILABLE");
     if (this.active) this.active.refreshUsed = true;
     else this.startupRefreshUsed = true;
@@ -741,7 +812,7 @@ var ManagedCodexDriver = class extends AgentDriver {
         effort: this.config.effort ?? this.config.driverOptions.codex.reasoningEffort
       });
       if (this.active !== active) return;
-      if (!record(response.turn) || typeof response.turn.id !== "string") throw failure();
+      if (!record2(response.turn) || typeof response.turn.id !== "string") throw failure();
       active.id = response.turn.id;
       active.readyNow();
       for (const event of active.events.splice(0)) this.notification(event.method, event.params);
@@ -812,7 +883,8 @@ var ManagedCodexDriver = class extends AgentDriver {
     this.pendingPatch = { ...this.pendingPatch, ...patch };
   }
   closeGeneration() {
-    ++this.generation;
+    const generation = ++this.generation;
+    const finalMcp = { ...this.mcpDiagnostics };
     this.mcpStartup = "unknown";
     this.pendingMcpStartup = void 0;
     this.controller.abort();
@@ -835,14 +907,19 @@ var ManagedCodexDriver = class extends AgentDriver {
         if (pendingClient && pendingClient !== client) await pendingClient.dispose();
         if (client && !client.terminationConfirmed || pendingClient && !pendingClient.terminationConfirmed)
           this.cleanupUncertain = true;
-        if (tools)
-          await bounded(
-            Promise.resolve().then(() => tools.dispose()),
-            new AbortController().signal,
-            1e3
-          ).catch(() => {
+        if (tools) {
+          try {
+            await bounded(
+              Promise.resolve().then(() => tools.dispose()),
+              new AbortController().signal,
+              1e3
+            );
+            if (generation === this.generation && !this.cleanupUncertain)
+              this.observeClosedMcp(tools, finalMcp);
+          } catch {
             this.cleanupUncertain = true;
-          });
+          }
+        }
       } finally {
         instance?.release();
       }
@@ -852,7 +929,7 @@ var ManagedCodexDriver = class extends AgentDriver {
     return this.closing;
   }
   notification(method, params) {
-    if (!record(params)) return;
+    if (!record2(params)) return;
     if (method === "mcpServer/startupStatus/updated") {
       const serverName = this.tools?.diagnostics?.serverName;
       if (!serverName || params.name !== serverName || typeof params.threadId !== "string" || params.threadId.length > 512 || typeof params.status !== "string" || !["starting", "ready", "failed", "cancelled"].includes(params.status))
@@ -869,7 +946,7 @@ var ManagedCodexDriver = class extends AgentDriver {
       return;
     }
     const active = this.active;
-    if ((!active || !active.usageCursor && this.resumeUsageTurnIds.has(String(params.turnId))) && method === "thread/tokenUsage/updated" && params.threadId === (this.threadId ?? this.config.resumeSessionId) && record(params.tokenUsage) && record(params.tokenUsage.total)) {
+    if ((!active || !active.usageCursor && this.resumeUsageTurnIds.has(String(params.turnId))) && method === "thread/tokenUsage/updated" && params.threadId === (this.threadId ?? this.config.resumeSessionId) && record2(params.tokenUsage) && record2(params.tokenUsage.total)) {
       this.threadUsageTotal = nativeUsage(params.tokenUsage.total);
       if (active) active.usageBaseline = this.threadUsageTotal;
       return;
@@ -883,12 +960,12 @@ var ManagedCodexDriver = class extends AgentDriver {
       } else active.events.push({ method, params });
       return;
     }
-    const turnId = record(params.turn) ? params.turn.id : params.turnId;
+    const turnId = record2(params.turn) ? params.turn.id : params.turnId;
     if (turnId !== active.id) return;
-    if (method === "thread/tokenUsage/updated" && record(params.tokenUsage)) {
+    if (method === "thread/tokenUsage/updated" && record2(params.tokenUsage)) {
       const last = params.tokenUsage.last;
       const total = params.tokenUsage.total;
-      const cumulativeUsage = record(total) ? nativeUsage(total) : void 0;
+      const cumulativeUsage = record2(total) ? nativeUsage(total) : void 0;
       if (cumulativeUsage) {
         active.usageBaseline ??= {};
         this.resumeUsageTurnIds.clear();
@@ -900,7 +977,7 @@ var ManagedCodexDriver = class extends AgentDriver {
         active.usageCursor = cumulativeUsage;
         this.threadUsageTotal = cumulativeUsage;
       }
-      if (record(last)) {
+      if (record2(last)) {
         if (typeof last.totalTokens === "number") active.contextTokens = last.totalTokens;
       }
       if (typeof params.tokenUsage.modelContextWindow === "number")
@@ -908,7 +985,7 @@ var ManagedCodexDriver = class extends AgentDriver {
     } else if (method === "model/rerouted") {
       active.actualModel = typeof params.toModel === "string" ? params.toModel : active.actualModel;
       active.failureCode = "CODEX_MODEL_UNAVAILABLE";
-    } else if (method === "turn/completed" && record(params.turn)) this.complete(params.turn);
+    } else if (method === "turn/completed" && record2(params.turn)) this.complete(params.turn);
     else if (method === "error" && params.willRetry !== true)
       active.failureCode = this.nativeErrorCode(params.error);
     else if (method === "item/agentMessage/delta" && typeof params.itemId === "string" && typeof params.delta === "string") {
@@ -918,14 +995,14 @@ var ManagedCodexDriver = class extends AgentDriver {
           type: "message_start",
           message: { role: "assistant", content: [{ type: "text", text: "" }] }
         });
-      const text = (previous ?? "") + params.delta;
-      active.messages.set(params.itemId, text);
+      const text2 = (previous ?? "") + params.delta;
+      active.messages.set(params.itemId, text2);
       this.event({
         type: "message_update",
-        message: { role: "assistant", content: [{ type: "text", text }] },
+        message: { role: "assistant", content: [{ type: "text", text: text2 }] },
         _textDelta: params.delta
       });
-    } else if ((method === "item/started" || method === "item/completed") && record(params.item) && typeof params.item.id === "string") {
+    } else if ((method === "item/started" || method === "item/completed") && record2(params.item) && typeof params.item.id === "string") {
       this.item(
         params.item,
         method === "item/completed"
@@ -1009,11 +1086,11 @@ var ManagedCodexDriver = class extends AgentDriver {
       this.finishTurn(this.active?.failureCode ?? this.nativeErrorCode(turn.error));
   }
   nativeErrorCode(error) {
-    const info = record(error) ? error.codexErrorInfo : void 0;
+    const info = record2(error) ? error.codexErrorInfo : void 0;
     if (info === "unauthorized") return "CODEX_RECONNECT_REQUIRED";
     if (info === "usageLimitExceeded" || info === "rateLimitExceeded" || info === "serverOverloaded")
       return "CODEX_RATE_LIMITED";
-    if (record(info) && [
+    if (record2(info) && [
       "httpConnectionFailed",
       "responseStreamConnectionFailed",
       "responseStreamDisconnected",
@@ -1039,9 +1116,31 @@ var ManagedCodexDriver = class extends AgentDriver {
     this.mcpDiagnostics.startupAtEnd = this.mcpStartup;
     this.mcpDiagnostics.toolsListTotal = Math.max(this.mcpDiagnostics.toolsListBeforeTurn, listed);
     this.mcpDiagnostics.toolsCallTotal = beforeTurn ? called : Math.max(this.mcpDiagnostics.toolsCallTotal, called);
+    this.publishMcp(this.mcpDiagnostics);
+  }
+  observeClosedMcp(tools, snapshot) {
+    try {
+      const counts = tools.diagnostics?.requestCounts();
+      if (!counts || ![counts.toolsListTotal, counts.toolsCallTotal].every(
+        (value) => Number.isSafeInteger(value) && value >= 0
+      ))
+        return;
+      snapshot.toolsListTotal = Math.max(
+        snapshot.toolsListTotal,
+        Math.min(512, counts.toolsListTotal)
+      );
+      snapshot.toolsCallTotal = Math.max(
+        snapshot.toolsCallTotal,
+        Math.min(512, counts.toolsCallTotal)
+      );
+      this.publishMcp(snapshot);
+    } catch {
+    }
+  }
+  publishMcp(snapshot) {
     try {
       void Promise.resolve(
-        this.options?.onNativeMcpDiagnostics?.(Object.freeze({ ...this.mcpDiagnostics }))
+        this.options?.onNativeMcpDiagnostics?.(Object.freeze({ ...snapshot }))
       ).catch(() => {
       });
     } catch {
@@ -1056,10 +1155,10 @@ var ManagedCodexDriver = class extends AgentDriver {
     active.controller.abort();
     active.fileChanges.clear();
     active.readyNow();
-    for (const text of active.messages.values())
+    for (const text2 of active.messages.values())
       this.event({
         type: "message_end",
-        message: { role: "assistant", content: [{ type: "text", text }] }
+        message: { role: "assistant", content: [{ type: "text", text: text2 }] }
       });
     this.event({ type: "turn_end", toolResults: active.toolResults });
     const modelUsage = active.usage ? {
@@ -1546,10 +1645,10 @@ var CodexDriver = class extends AgentDriver {
     });
     this.pendingToolResults = [];
   }
-  buildAssistantMessage(text) {
+  buildAssistantMessage(text2) {
     return {
       role: "assistant",
-      content: [{ type: "text", text }]
+      content: [{ type: "text", text: text2 }]
     };
   }
   toObject(value) {