@swarp/cli 0.1.2-rc.40 → 0.1.2-rc.42

package/dist/mcp-server.mjs

@@ -2989,7 +2989,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve5.call(this, root, ref);
+      let _sch = resolve6.call(this, root, ref);
       if (_sch === void 0) {
         const schema2 = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -3016,7 +3016,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve5(root, ref) {
+    function resolve6(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -3591,7 +3591,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve5(baseURI, relativeURI, options) {
+    function resolve6(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const resolved = resolveComponent(parse3(baseURI, schemelessOptions), parse3(relativeURI, schemelessOptions), schemelessOptions, true);
       schemelessOptions.skipEscape = true;
@@ -3818,7 +3818,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve5,
+      resolve: resolve6,
       resolveComponent,
       equal,
       serialize,
@@ -7349,7 +7349,7 @@ var require_call_credentials = __commonJS({
           if (isCurrentOauth2Client(googleCredentials)) {
             getHeaders = googleCredentials.getRequestHeaders(options.service_url);
           } else {
-            getHeaders = new Promise((resolve5, reject) => {
+            getHeaders = new Promise((resolve6, reject) => {
               googleCredentials.getRequestMetadata(options.service_url, (err, headers) => {
                 if (err) {
                   reject(err);
@@ -7359,7 +7359,7 @@ var require_call_credentials = __commonJS({
                   reject(new Error("Headers not set by metadata plugin"));
                   return;
                 }
-                resolve5(headers);
+                resolve6(headers);
               });
             });
           }
@@ -7412,10 +7412,10 @@ var require_call_credentials = __commonJS({
         this.metadataGenerator = metadataGenerator;
       }
       generateMetadata(options) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           this.metadataGenerator(options, (err, metadata) => {
             if (metadata !== void 0) {
-              resolve5(metadata);
+              resolve6(metadata);
             } else {
               reject(err);
             }
@@ -7774,14 +7774,14 @@ var require_channel_credentials = __commonJS({
       }
       connect(socket) {
         const tlsConnectOptions = Object.assign({ socket }, this.connectionOptions);
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           const tlsSocket = (0, tls_1.connect)(tlsConnectOptions, () => {
             var _a;
             if (((_a = this.connectionOptions.rejectUnauthorized) !== null && _a !== void 0 ? _a : true) && !tlsSocket.authorized) {
               reject(tlsSocket.authorizationError);
               return;
             }
-            resolve5({
+            resolve6({
               socket: tlsSocket,
               secure: true
             });
@@ -7900,8 +7900,8 @@ var require_channel_credentials = __commonJS({
         if (this.hasReceivedUpdates()) {
           return Promise.resolve(this.getLatestSecureContext());
         } else {
-          return new Promise((resolve5) => {
-            this.secureContextWatchers.push(resolve5);
+          return new Promise((resolve6) => {
+            this.secureContextWatchers.push(resolve6);
           });
         }
       }
@@ -7934,7 +7934,7 @@ var require_channel_credentials = __commonJS({
         this.callCredentials = callCredentials;
       }
       connect(socket) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           const secureContext = this.parent.getLatestSecureContext();
           if (!secureContext) {
             reject(new Error("Failed to load credentials"));
@@ -7959,7 +7959,7 @@ var require_channel_credentials = __commonJS({
               reject(tlsSocket.authorizationError);
               return;
             }
-            resolve5({
+            resolve6({
               socket: tlsSocket,
               secure: true
             });
@@ -11535,7 +11535,7 @@ var require_aspromise = __commonJS({
       var params = new Array(arguments.length - 1), offset = 0, index = 2, pending = true;
       while (index < arguments.length)
         params[offset++] = arguments[index++];
-      return new Promise(function executor(resolve5, reject) {
+      return new Promise(function executor(resolve6, reject) {
         params[offset] = function callback(err) {
           if (pending) {
             pending = false;
@@ -11545,7 +11545,7 @@ var require_aspromise = __commonJS({
               var params2 = new Array(arguments.length - 1), offset2 = 0;
               while (offset2 < params2.length)
                 params2[offset2++] = arguments[offset2];
-              resolve5.apply(null, params2);
+              resolve6.apply(null, params2);
             }
           }
         };
@@ -13057,7 +13057,7 @@ var require_path = __commonJS({
         return prefix + parts.join("/");
       }
     );
-    path2.resolve = function resolve5(originPath, includePath, alreadyNormalized) {
+    path2.resolve = function resolve6(originPath, includePath, alreadyNormalized) {
       if (!alreadyNormalized)
         includePath = normalize(includePath);
       if (isAbsolute(includePath))
@@ -13377,7 +13377,7 @@ var require_mapfield = __commonJS({
         keepComments ? this.comment : void 0
       ]);
     };
-    MapField.prototype.resolve = function resolve5() {
+    MapField.prototype.resolve = function resolve6() {
       if (this.resolved)
         return this;
       if (types2.mapKey[this.keyType] === void 0)
@@ -13454,7 +13454,7 @@ var require_method = __commonJS({
         this.parsedOptions
       ]);
     };
-    Method.prototype.resolve = function resolve5() {
+    Method.prototype.resolve = function resolve6() {
       if (this.resolved)
         return this;
       this.resolvedRequestType = this.parent.lookupType(this.requestType);
@@ -15017,7 +15017,7 @@ var require_field = __commonJS({
         keepComments ? this.comment : void 0
       ]);
     };
-    Field.prototype.resolve = function resolve5() {
+    Field.prototype.resolve = function resolve6() {
       if (this.resolved)
         return this;
       if ((this.typeDefault = types2.defaults[this.type]) === void 0) {
@@ -15290,7 +15290,7 @@ var require_object = __commonJS({
       this.parent = null;
       this.resolved = false;
     };
-    ReflectionObject.prototype.resolve = function resolve5() {
+    ReflectionObject.prototype.resolve = function resolve6() {
       if (this.resolved)
         return this;
       if (this.root instanceof Root)
@@ -21191,18 +21191,18 @@ var require_compression_filter = __commonJS({
         this.maxRecvMessageLength = maxRecvMessageLength;
       }
       compressMessage(message) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           zlib.deflate(message, (err, output) => {
             if (err) {
               reject(err);
             } else {
-              resolve5(output);
+              resolve6(output);
             }
           });
         });
       }
       decompressMessage(message) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           let totalLength = 0;
           const messageParts = [];
           const decompresser = zlib.createInflate();
@@ -21218,7 +21218,7 @@ var require_compression_filter = __commonJS({
             }
           });
           decompresser.on("end", () => {
-            resolve5(Buffer.concat(messageParts));
+            resolve6(Buffer.concat(messageParts));
           });
           decompresser.write(message);
           decompresser.end();
@@ -21231,18 +21231,18 @@ var require_compression_filter = __commonJS({
         this.maxRecvMessageLength = maxRecvMessageLength;
       }
       compressMessage(message) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           zlib.gzip(message, (err, output) => {
             if (err) {
               reject(err);
             } else {
-              resolve5(output);
+              resolve6(output);
             }
           });
         });
       }
       decompressMessage(message) {
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           let totalLength = 0;
           const messageParts = [];
           const decompresser = zlib.createGunzip();
@@ -21258,7 +21258,7 @@ var require_compression_filter = __commonJS({
             }
           });
           decompresser.on("end", () => {
-            resolve5(Buffer.concat(messageParts));
+            resolve6(Buffer.concat(messageParts));
           });
           decompresser.write(message);
           decompresser.end();
@@ -22593,7 +22593,7 @@ var require_http_proxy = __commonJS({
       options.headers = headers;
       const proxyAddressString = (0, subchannel_address_1.subchannelAddressToString)(address);
       trace("Using proxy " + proxyAddressString + " to connect to " + options.path);
-      return new Promise((resolve5, reject) => {
+      return new Promise((resolve6, reject) => {
         const request = http.request(options);
         request.once("connect", (res, socket, head) => {
           request.removeAllListeners();
@@ -22604,7 +22604,7 @@ var require_http_proxy = __commonJS({
               socket.unshift(head);
             }
             trace("Successfully established a plaintext connection to " + options.path + " through proxy " + proxyAddressString);
-            resolve5(socket);
+            resolve6(socket);
           } else {
             (0, logging_1.log)(constants_1.LogVerbosity.ERROR, "Failed to connect to " + options.path + " through proxy " + proxyAddressString + " with status " + res.statusCode);
             reject();
@@ -23504,7 +23504,7 @@ var require_transport = __commonJS({
         if (secureConnectResult.socket.closed) {
           return Promise.reject("Connection closed before starting HTTP/2 handshake");
         }
-        return new Promise((resolve5, reject) => {
+        return new Promise((resolve6, reject) => {
           var _a, _b, _c, _d, _e, _f, _g, _h;
           let remoteName = null;
           let realTarget = this.channelTarget;
@@ -23573,7 +23573,7 @@ var require_transport = __commonJS({
             session.removeAllListeners();
             secureConnectResult.socket.removeListener("close", closeHandler);
             secureConnectResult.socket.removeListener("error", errorHandler);
-            resolve5(new Http2Transport(session, address, options, remoteName));
+            resolve6(new Http2Transport(session, address, options, remoteName));
             this.session = null;
           });
           session.once("close", closeHandler);
@@ -23587,7 +23587,7 @@ var require_transport = __commonJS({
           if (proxiedSocket) {
             return proxiedSocket;
           } else {
-            return new Promise((resolve5, reject) => {
+            return new Promise((resolve6, reject) => {
               const closeCallback = () => {
                 reject(new Error("Socket closed"));
               };
@@ -23597,7 +23597,7 @@ var require_transport = __commonJS({
               const socket = net.connect(address, () => {
                 socket.removeListener("close", closeCallback);
                 socket.removeListener("error", errorCallback);
-                resolve5(socket);
+                resolve6(socket);
               });
               socket.once("close", closeCallback);
               socket.once("error", errorCallback);
@@ -26901,7 +26901,7 @@ var require_server_interceptors = __commonJS({
           } else {
             decompresser = zlib.createGunzip();
           }
-          return new Promise((resolve5, reject) => {
+          return new Promise((resolve6, reject) => {
             let totalLength = 0;
             const messageParts = [];
             decompresser.on("data", (chunk) => {
@@ -26916,7 +26916,7 @@ var require_server_interceptors = __commonJS({
               }
             });
             decompresser.on("end", () => {
-              resolve5(Buffer.concat(messageParts));
+              resolve6(Buffer.concat(messageParts));
             });
             decompresser.write(messageContents);
             decompresser.end();
@@ -27506,10 +27506,10 @@ var require_server = __commonJS({
         bindOneAddress(address, boundPortObject) {
           this.trace("Attempting to bind " + (0, subchannel_address_1.subchannelAddressToString)(address));
           const http2Server = this.createHttp2Server(boundPortObject.credentials);
-          return new Promise((resolve5, reject) => {
+          return new Promise((resolve6, reject) => {
             const onError = (err) => {
               this.trace("Failed to bind " + (0, subchannel_address_1.subchannelAddressToString)(address) + " with error " + err.message);
-              resolve5({
+              resolve6({
                 port: "port" in address ? address.port : 1,
                 error: err.message
               });
@@ -27537,7 +27537,7 @@ var require_server = __commonJS({
               });
               boundPortObject.listeningServers.add(http2Server);
               this.trace("Successfully bound " + (0, subchannel_address_1.subchannelAddressToString)(boundSubchannelAddress));
-              resolve5({
+              resolve6({
                 port: "port" in boundSubchannelAddress ? boundSubchannelAddress.port : 1
               });
               http2Server.removeListener("error", onError);
@@ -27590,7 +27590,7 @@ var require_server = __commonJS({
           }
         }
         resolvePort(port) {
-          return new Promise((resolve5, reject) => {
+          return new Promise((resolve6, reject) => {
             let seenResolution = false;
             const resolverListener = (endpointList, attributes, serviceConfig, resolutionNote) => {
               if (seenResolution) {
@@ -27606,7 +27606,7 @@ var require_server = __commonJS({
                 reject(new Error(`No addresses resolved for port ${port}`));
                 return true;
               }
-              resolve5(addressList);
+              resolve6(addressList);
               return true;
             };
             const resolver = (0, resolver_1.createResolver)(port, resolverListener, this.options);
@@ -43662,7 +43662,7 @@ var Protocol = class {
           return;
         }
         const pollInterval = task2.pollInterval ?? this._options?.defaultTaskPollInterval ?? 1e3;
-        await new Promise((resolve5) => setTimeout(resolve5, pollInterval));
+        await new Promise((resolve6) => setTimeout(resolve6, pollInterval));
         options?.signal?.throwIfAborted();
       }
     } catch (error2) {
@@ -43679,7 +43679,7 @@ var Protocol = class {
    */
   request(request, resultSchema, options) {
     const { relatedRequestId, resumptionToken, onresumptiontoken, task, relatedTask } = options ?? {};
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       const earlyReject = (error2) => {
         reject(error2);
       };
@@ -43757,7 +43757,7 @@ var Protocol = class {
           if (!parseResult.success) {
             reject(parseResult.error);
           } else {
-            resolve5(parseResult.data);
+            resolve6(parseResult.data);
           }
         } catch (error2) {
           reject(error2);
@@ -44018,12 +44018,12 @@ var Protocol = class {
       }
     } catch {
     }
-    return new Promise((resolve5, reject) => {
+    return new Promise((resolve6, reject) => {
       if (signal.aborted) {
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
         return;
       }
-      const timeoutId = setTimeout(resolve5, interval);
+      const timeoutId = setTimeout(resolve6, interval);
       signal.addEventListener("abort", () => {
         clearTimeout(timeoutId);
         reject(new McpError(ErrorCode.InvalidRequest, "Request cancelled"));
@@ -44893,12 +44893,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve5) => {
+    return new Promise((resolve6) => {
       const json2 = serializeMessage(message);
       if (this._stdout.write(json2)) {
-        resolve5();
+        resolve6();
       } else {
-        this._stdout.once("drain", resolve5);
+        this._stdout.once("drain", resolve6);
       }
     });
   }
@@ -44940,18 +44940,18 @@ var DispatchClient = class {
     }
   }
   listAgents() {
-    return new Promise((resolve5, reject) => {
-      this.stub.ListAgents({}, (err, res) => err ? reject(err) : resolve5(res));
+    return new Promise((resolve6, reject) => {
+      this.stub.ListAgents({}, (err, res) => err ? reject(err) : resolve6(res));
     });
   }
   cancelTask(taskId) {
-    return new Promise((resolve5, reject) => {
-      this.stub.CancelTask({ task_id: taskId }, (err, res) => err ? reject(err) : resolve5(res));
+    return new Promise((resolve6, reject) => {
+      this.stub.CancelTask({ task_id: taskId }, (err, res) => err ? reject(err) : resolve6(res));
     });
   }
   getAgentStatus(agent) {
-    return new Promise((resolve5, reject) => {
-      this.stub.GetAgentStatus({ agent }, (err, res) => err ? reject(err) : resolve5(res));
+    return new Promise((resolve6, reject) => {
+      this.stub.GetAgentStatus({ agent }, (err, res) => err ? reject(err) : resolve6(res));
     });
   }
   close() {
@@ -44964,11 +44964,11 @@ function callToAsyncIterator(call) {
       const queue = [];
       let done = false;
       let error2 = null;
-      let resolve5 = null;
+      let resolve6 = null;
       call.on("data", (chunk) => {
-        if (resolve5) {
-          const r = resolve5;
-          resolve5 = null;
+        if (resolve6) {
+          const r = resolve6;
+          resolve6 = null;
           r({ value: chunk, done: false });
         } else {
           queue.push(chunk);
@@ -44976,17 +44976,17 @@ function callToAsyncIterator(call) {
       });
       call.on("end", () => {
         done = true;
-        if (resolve5) {
-          const r = resolve5;
-          resolve5 = null;
+        if (resolve6) {
+          const r = resolve6;
+          resolve6 = null;
           r({ value: void 0, done: true });
         }
       });
       call.on("error", (err) => {
         error2 = err;
-        if (resolve5) {
-          const r = resolve5;
-          resolve5 = null;
+        if (resolve6) {
+          const r = resolve6;
+          resolve6 = null;
           r(Promise.reject(err));
         }
       });
@@ -45000,7 +45000,7 @@ function callToAsyncIterator(call) {
             return Promise.resolve({ value: void 0, done: true });
           }
           return new Promise((res) => {
-            resolve5 = res;
+            resolve6 = res;
           });
         }
       };
@@ -45335,13 +45335,19 @@ function nextPhase() {
   return null;
 }
 function checkPrerequisites() {
+  const versionFlags = { flyctl: "version", sprite: "--version", gh: "--version" };
   const results = [];
   for (const tool of ["flyctl", "sprite", "gh"]) {
     try {
       execFileSync("which", [tool], { stdio: "ignore" });
-      results.push({ tool, installed: true });
+      let version2 = "unknown";
+      try {
+        version2 = execFileSync(tool, [versionFlags[tool]], { encoding: "utf-8", timeout: 5e3 }).trim().split("\n")[0];
+      } catch {
+      }
+      results.push({ tool, installed: true, version: version2 });
     } catch {
-      results.push({ tool, installed: false });
+      results.push({ tool, installed: false, version: null });
     }
   }
   return results;
@@ -45443,7 +45449,21 @@ async function handleOnboard(toolArgs) {
   if (action === "check_prerequisites") {
     const results = checkPrerequisites();
     const allInstalled = results.every((r) => r.installed);
-    const lines = results.map((r) => `  ${r.installed ? "\u2713" : "\u2717"} ${r.tool}`);
+    const lines = results.map((r) => `  ${r.installed ? "\u2713" : "\u2717"} ${r.tool} \u2014 ${r.installed ? `installed (${r.version})` : "not installed"}`);
+    const missing = results.filter((r) => !r.installed);
+    const installInstructions = missing.map((r) => {
+      switch (r.tool) {
+        case "flyctl":
+          return `Install flyctl by running: curl -L https://fly.io/install.sh | sh
+Then authenticate: fly auth login`;
+        case "sprite":
+          return `Install sprite by running: curl -fsSL https://sprites.dev/install.sh | sh`;
+        case "gh":
+          return `Install gh by running: (type -p wget >/dev/null || (apt-get update && apt-get install -y wget)) && mkdir -p /etc/apt/keyrings && wget -qO- https://cli.github.com/packages/githubcli-archive-keyring.gpg | tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | tee /etc/apt/sources.list.d/github-cli.list > /dev/null && apt-get update && apt-get install -y gh`;
+        default:
+          return `Install ${r.tool} manually.`;
+      }
+    });
     return {
       content: [{
         type: "text",
@@ -45451,7 +45471,14 @@ async function handleOnboard(toolArgs) {
           "Prerequisite check:",
           ...lines,
           "",
-          allInstalled ? 'All prerequisites met. Run swarp_onboard with action="complete_phase" phase="prerequisites" to advance.' : "Missing tools must be installed before continuing."
+          allInstalled ? 'All prerequisites met. Run swarp_onboard with action="complete_phase" phase="prerequisites" to advance.' : [
+            `${missing.length} missing tool(s). Install them now:`,
+            "",
+            ...installInstructions,
+            "",
+            "Run these install commands directly \u2014 Claude Code will ask for permission.",
+            'After installing, run swarp_onboard with action="check_prerequisites" again to verify.'
+          ].join("\n")
         ].join("\n")
       }]
     };
@@ -45462,25 +45489,30 @@ function getPhaseInstructions(phase, state) {
   switch (phase) {
     case "prerequisites":
       return [
-        "Check that required CLIs are installed:",
-        "  - flyctl (Fly.io CLI): https://fly.io/docs/getting-started/installing-flyctl/",
-        "  - sprite (Fly Sprites CLI): https://sprites.dev",
-        "  - gh (GitHub CLI): https://cli.github.com",
+        'Check that required CLIs are installed by running swarp_onboard action="check_prerequisites".',
         "",
-        'Run swarp_onboard with action="check_prerequisites" to verify.'
+        "If any tools are missing, install them by running the provided install commands directly.",
+        "Claude Code permissions will gate execution \u2014 just run the commands.",
+        "After installing, re-run check_prerequisites to verify, then complete the phase."
       ].join("\n");
     case "router":
       return [
         "Deploy the SWARP router to Fly.io.",
         "",
+        "Before calling swarp_deploy_router, make sure the user has:",
+        "  a. A swarp.dev CLI token in .env as SWARP_AUTH_TOKEN. If missing,",
+        "     guide them: sign in at https://swarp.dev, generate a token at",
+        "     https://swarp.dev/account, then add it to .env in this directory.",
+        "  b. flyctl installed and authenticated (fly auth login).",
+        "",
         "Steps:",
-        "1. Ask the user for their Fly.io org name",
-        "2. Use swarp_deploy_router tool with the org name",
-        "   (This will show a cost estimate and require user approval)",
-        "3. Save router_url and fly_app to config:",
-        '   swarp_onboard action="save_config" key="router_url" value="<url>"',
-        '   swarp_onboard action="save_config" key="fly_app" value="<app-name>"',
-        '   swarp_onboard action="save_config" key="fly_org" value="<org>"',
+        '1. Ask the user for their Fly.io org name (default: "personal")',
+        '2. Call swarp_deploy_router with { "fly_org": "<org>" }',
+        "   The cost confirmation hook will show an estimate (~$2.09/mo)",
+        "   and ask for approval before anything is created.",
+        "   The tool is idempotent \u2014 safe to re-run if something fails.",
+        "3. On success the tool saves router_url, fly_app, and fly_org",
+        "   to .swarp.json automatically \u2014 no additional save_config calls.",
         '4. Complete: swarp_onboard action="complete_phase" phase="router"'
       ].join("\n");
     case "secrets":
@@ -45538,6 +45570,318 @@ var onboardToolDef = {
   }
 };
 
+// src/mcp-server/deploy-router.mjs
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { mkdtempSync, writeFileSync as writeFileSync3, readFileSync as readFileSync5, existsSync as existsSync5 } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join3, resolve as resolve5 } from "node:path";
+var DEFAULT_SWARP_API_BASE = "https://xzcysgjzygqhfdrriibs.supabase.co";
+var DEFAULT_REGION = "dfw";
+var DEFAULT_APP_NAME_PREFIX = "swarp-router";
+var DEFAULT_ROUTER_IMAGE = "ghcr.io/dl3consulting/swarp-router:latest";
+function loadDotEnv(cwd) {
+  const envPath = resolve5(cwd, ".env");
+  if (!existsSync5(envPath)) return {};
+  const content = readFileSync5(envPath, "utf-8");
+  const out = {};
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eqIdx = line.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = line.slice(0, eqIdx).trim();
+    let value = line.slice(eqIdx + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function resolveVar(name, dotEnv) {
+  return process.env[name] ?? dotEnv[name];
+}
+var FLY_TOML_TEMPLATE = (image, appName) => `
+app = "${appName}"
+primary_region = "${DEFAULT_REGION}"
+
+[build]
+  image = "${image}"
+
+[processes]
+  router = "/usr/local/bin/swarp-router"
+
+[[mounts]]
+  source = "swarp_data"
+  destination = "/data"
+  processes = ["router"]
+
+# gRPC router: Fly HTTP proxy terminates TLS, forwards h2c to :50051.
+# h2_backend is required for gRPC \u2014 tells Fly to speak HTTP/2 to the backend.
+[http_service]
+  internal_port = 50051
+  processes = ["router"]
+  force_https = true
+  [http_service.http_options]
+    h2_backend = true
+`.trim() + "\n";
+function flyctl(args, opts = {}) {
+  try {
+    return execFileSync2("flyctl", args, {
+      encoding: "utf-8",
+      timeout: opts.timeout ?? 6e4,
+      stdio: opts.stdio ?? ["ignore", "pipe", "pipe"],
+      ...opts
+    });
+  } catch (err) {
+    const stderr = err.stderr?.toString() ?? "";
+    const stdout = err.stdout?.toString() ?? "";
+    const message = stderr || stdout || err.message;
+    throw new Error(`flyctl ${args[0]} failed: ${message.trim()}`);
+  }
+}
+async function provisionInstallSecret({ authToken, apiBase, flyOrg, flyApp }) {
+  const url = `${apiBase}/functions/v1/swarp-install-provision`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${authToken}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ fly_org: flyOrg, fly_app: flyApp })
+  });
+  if (!res.ok) {
+    const body = await res.text();
+    throw new Error(`swarp.dev provision failed: ${res.status} ${body}`);
+  }
+  return res.json();
+}
+function appExists(appName) {
+  try {
+    const output = flyctl(["apps", "list", "--json"]);
+    const apps = JSON.parse(output);
+    return apps.some((a) => (a.Name ?? a.name) === appName);
+  } catch {
+    return false;
+  }
+}
+function volumeExists(appName) {
+  try {
+    const output = flyctl(["volumes", "list", "--app", appName, "--json"]);
+    const volumes = JSON.parse(output);
+    return volumes.some((v) => v.name === "swarp_data" || v.Name === "swarp_data");
+  } catch {
+    return false;
+  }
+}
+function createApp(appName, flyOrg) {
+  flyctl(["apps", "create", appName, "--org", flyOrg], { timeout: 3e4 });
+}
+function createVolume(appName, region) {
+  flyctl([
+    "volumes",
+    "create",
+    "swarp_data",
+    "--app",
+    appName,
+    "--region",
+    region,
+    "--size",
+    "1",
+    "--yes"
+  ], { timeout: 6e4 });
+}
+function setSecret(appName, key, value) {
+  execFileSync2(
+    "flyctl",
+    ["secrets", "set", "--app", appName, "--stage", `${key}=${value}`],
+    { stdio: ["ignore", "pipe", "pipe"], timeout: 3e4 }
+  );
+}
+function deploy(configPath, appName) {
+  flyctl([
+    "deploy",
+    "--config",
+    configPath,
+    "--app",
+    appName,
+    "--now",
+    "--ha=false"
+  ], { timeout: 6e5 });
+}
+function getAppUrl(appName) {
+  try {
+    const output = flyctl(["status", "--app", appName, "--json"]);
+    const status = JSON.parse(output);
+    return status.Hostname ?? status.hostname ?? `${appName}.fly.dev`;
+  } catch {
+    return `${appName}.fly.dev`;
+  }
+}
+function writeSwarpConfig(configPath, updates) {
+  const existing = existsSync5(configPath) ? JSON.parse(readFileSync5(configPath, "utf-8")) : {};
+  const merged = { ...existing, ...updates };
+  writeFileSync3(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  return merged;
+}
+async function handleDeployRouter(toolArgs) {
+  const { fly_org: flyOrg, app_name: appNameInput, region = DEFAULT_REGION } = toolArgs ?? {};
+  if (!flyOrg) {
+    return {
+      content: [{ type: "text", text: 'Error: fly_org is required. Example: { "fly_org": "personal" }' }],
+      isError: true
+    };
+  }
+  const dotEnv = loadDotEnv(process.cwd());
+  const authToken = resolveVar("SWARP_AUTH_TOKEN", dotEnv);
+  if (!authToken) {
+    return {
+      content: [{
+        type: "text",
+        text: [
+          "Error: SWARP_AUTH_TOKEN is not set.",
+          "",
+          "The plugin needs your swarp.dev session token to fetch a unique",
+          "HMAC signing key for your router. To generate it:",
+          "",
+          "  1. Sign in at https://swarp.dev with your Google account",
+          '  2. Go to https://swarp.dev/account and click "Generate CLI token"',
+          "  3. Copy the token and add it to a .env file in this directory:",
+          "",
+          `     echo 'SWARP_AUTH_TOKEN="<paste-token-here>"' >> .env`,
+          "",
+          "  4. Re-run swarp_deploy_router",
+          "",
+          "The token grants the plugin permission to provision and retrieve",
+          "install secrets on your behalf. Treat it like a password \u2014 never",
+          "commit .env to git (it should be in .gitignore already)."
+        ].join("\n")
+      }],
+      isError: true
+    };
+  }
+  const routerImage = resolveVar("SWARP_ROUTER_IMAGE", dotEnv) ?? DEFAULT_ROUTER_IMAGE;
+  try {
+    flyctl(["auth", "whoami"], { timeout: 1e4 });
+  } catch {
+    return {
+      content: [{
+        type: "text",
+        text: "Error: flyctl is not authenticated. Run: fly auth login"
+      }],
+      isError: true
+    };
+  }
+  const apiBase = resolveVar("SWARP_API_BASE", dotEnv) ?? DEFAULT_SWARP_API_BASE;
+  const appName = appNameInput ?? DEFAULT_APP_NAME_PREFIX;
+  const configPath = resolve5(".swarp.json");
+  const steps = [];
+  try {
+    steps.push("\u2192 Fetching install secret from swarp.dev...");
+    const install = await provisionInstallSecret({
+      authToken,
+      apiBase,
+      flyOrg,
+      flyApp: appName
+    });
+    steps.push(`  ${install.existed ? "\u21BB Reusing existing install secret" : "\u2713 New install secret provisioned"}`);
+    const exists = appExists(appName);
+    if (exists) {
+      steps.push(`  \u21BB Fly app "${appName}" already exists \u2014 skipping create`);
+    } else {
+      steps.push(`\u2192 Creating Fly app "${appName}" in org "${flyOrg}"...`);
+      createApp(appName, flyOrg);
+      steps.push("  \u2713 App created");
+    }
+    if (!volumeExists(appName)) {
+      steps.push('\u2192 Creating 1GB volume "swarp_data"...');
+      createVolume(appName, region);
+      steps.push("  \u2713 Volume created");
+    } else {
+      steps.push('  \u21BB Volume "swarp_data" already exists');
+    }
+    steps.push("\u2192 Setting SUPABASE_JWT_SECRET (staged)...");
+    setSecret(appName, "SUPABASE_JWT_SECRET", install.jwt_secret);
+    steps.push("  \u2713 Secret staged");
+    const tmpDir = mkdtempSync(join3(tmpdir(), "swarp-deploy-"));
+    const tomlPath = join3(tmpDir, "fly.toml");
+    writeFileSync3(tomlPath, FLY_TOML_TEMPLATE(routerImage, appName), "utf-8");
+    steps.push(`\u2192 Deploying router image ${routerImage}...`);
+    deploy(tomlPath, appName);
+    steps.push("  \u2713 Deploy complete");
+    const hostname2 = getAppUrl(appName);
+    const routerUrl = `${hostname2}:443`;
+    writeSwarpConfig(configPath, {
+      router_url: routerUrl,
+      fly_app: appName,
+      fly_org: flyOrg
+    });
+    try {
+      await provisionInstallSecret({
+        authToken,
+        apiBase,
+        flyOrg,
+        flyApp: appName
+      });
+    } catch (err) {
+      steps.push(`  \u26A0 Could not update swarp.dev with final URL: ${err.message}`);
+    }
+    return {
+      content: [{
+        type: "text",
+        text: [
+          ...steps,
+          "",
+          `Router deployed: https://${hostname2}`,
+          `gRPC endpoint: ${routerUrl}`,
+          "",
+          "Config saved to .swarp.json.",
+          'Run swarp_onboard action="complete_phase" phase="router" to advance.'
+        ].join("\n")
+      }]
+    };
+  } catch (err) {
+    return {
+      content: [{
+        type: "text",
+        text: [
+          ...steps,
+          "",
+          `Error: ${err.message}`,
+          "",
+          "You can re-run this tool \u2014 it is idempotent (existing apps and volumes are skipped)."
+        ].join("\n")
+      }],
+      isError: true
+    };
+  }
+}
+var deployRouterToolDef = {
+  name: "swarp_deploy_router",
+  description: "Deploy the SWARP gRPC router to Fly.io. Creates the app, volume, and machine, sets the per-user install secret, and saves router_url to .swarp.json. Idempotent. Requires flyctl installed and authenticated, and SWARP_AUTH_TOKEN set in a .env file in the project directory (generate the token at https://swarp.dev/account).",
+  inputSchema: {
+    type: "object",
+    properties: {
+      fly_org: {
+        type: "string",
+        description: 'Fly.io organization slug to deploy into (e.g. "personal")'
+      },
+      app_name: {
+        type: "string",
+        description: 'Fly app name (default: "swarp-router")'
+      },
+      region: {
+        type: "string",
+        description: 'Fly region code (default: "dfw")'
+      }
+    },
+    required: ["fly_org"]
+  },
+  annotations: {
+    destructiveHint: true
+  }
+};
+
 // src/mcp-server/index.mjs
 async function startMcpServer() {
   let config2 = {};
@@ -45566,8 +45910,9 @@ async function startMcpServer() {
     }
   }
   const localTools = client ? buildLocalTools(config2) : [];
+  const onboardingTools = [onboardToolDef, deployRouterToolDef];
   server.setRequestHandler(ListToolsRequestSchema, async () => {
-    return { tools: [onboardToolDef, ...agentTools, ...localTools] };
+    return { tools: [...onboardingTools, ...agentTools, ...localTools] };
   });
   server.setRequestHandler(CallToolRequestSchema, async (req) => {
     const { name, arguments: toolArgs } = req.params;
@@ -45576,6 +45921,7 @@ async function startMcpServer() {
       return handleAgentDispatch(client, agent.name, toolArgs);
     }
     if (name === "swarp_onboard") return handleOnboard(toolArgs);
+    if (name === "swarp_deploy_router") return handleDeployRouter(toolArgs);
     if (name === "swarm_audit") return handleAudit(config2, toolArgs);
     if (name === "swarm_generate") return handleGenerate(config2, toolArgs);
     if (name === "swarm_status") return handleStatus(client, toolArgs);
@@ -45753,19 +46099,19 @@ async function handleDeploy(config2, toolArgs) {
     };
   }
   try {
-    const { readFileSync: readFileSync5, existsSync: existsSync5 } = await import("node:fs");
-    const { resolve: resolve5, join: join3 } = await import("node:path");
+    const { readFileSync: readFileSync6, existsSync: existsSync6 } = await import("node:fs");
+    const { resolve: resolve6, join: join4 } = await import("node:path");
     const yaml = (await Promise.resolve().then(() => (init_js_yaml(), js_yaml_exports))).default;
     const { FlySpriteAdapter: FlySpriteAdapter2 } = await Promise.resolve().then(() => (init_fly_sprites(), fly_sprites_exports));
-    const agentsDir = resolve5(config2.agents_dir ?? "agents");
-    const yamlPath = join3(agentsDir, agentName, "agent.yaml");
-    if (!existsSync5(yamlPath)) {
+    const agentsDir = resolve6(config2.agents_dir ?? "agents");
+    const yamlPath = join4(agentsDir, agentName, "agent.yaml");
+    if (!existsSync6(yamlPath)) {
       return {
         content: [{ type: "text", text: `Error: agent.yaml not found at ${yamlPath}` }],
         isError: true
       };
     }
-    const agentConfig = yaml.load(readFileSync5(yamlPath, "utf-8"));
+    const agentConfig = yaml.load(readFileSync6(yamlPath, "utf-8"));
     const adapter = new FlySpriteAdapter2(token);
     await adapter.createAgent(agentName, agentConfig);
     return { content: [{ type: "text", text: `Deployed ${agentName}` }] };