@vibesdotdev/mcp 0.0.0-stage → 1.0.0-rc.0

package/dist/cli/mcp/schemas/status-doctor.d.ts

@@ -0,0 +1,75 @@
+import type { collectRulesDebtSummary } from '../management/rules-debt-summary.impl.consumer.ts';
+export type McpServeProcess = {
+    pid: number;
+    ppid: number;
+    elapsedSeconds: number | null;
+    command: string;
+    clientId: string | null;
+    mode: 'stdio' | 'http' | 'unknown';
+};
+export type McpClientGroup = {
+    clientId: string;
+    count: number;
+    pids: number[];
+    modes: Array<'stdio' | 'http' | 'unknown'>;
+};
+export type HeuristicCandidate = McpServeProcess & {
+    reason: 'orphan-stdio-client' | 'untagged-stdio-long-running';
+};
+export type RulesDebtSummary = Awaited<ReturnType<typeof collectRulesDebtSummary>>;
+export type McpDoctorReport = {
+    timestamp: string;
+    pm: {
+        running: boolean;
+        reachable: boolean;
+        /**
+         * false when the daemon probe itself rejected or outlived the doctor
+         * timeout: `running`/`reachable` are then seeds, not readings.
+         */
+        measured: boolean;
+        /** Why the probe could not answer. Present only when `measured` is false. */
+        error?: string;
+    };
+    mcp: {
+        running: boolean;
+        /** `'unknown'` until PM has been consulted; `'missing'` is a measured absence. */
+        status: string;
+        /** false when PM was unreachable, so its process table was never read. */
+        measured: boolean;
+    };
+    workers: {
+        consumerRunning: boolean;
+        cloudRunning: boolean;
+        ready: boolean;
+        /**
+         * Why readiness could not be measured: the worker probe failed for a
+         * reason other than "nothing is listening". `ready` is then a seed, not a
+         * reading, and the failure is diagnosed, never reported as "not running".
+         */
+        error?: string;
+    };
+    resources: {
+        total: number;
+        ready: number;
+        nonReady: Array<{
+            id: string;
+            status: string;
+            error?: string;
+        }>;
+        /** Why PM's resource states could not be read; `total`/`ready` are then seeds. */
+        error?: string;
+    };
+    tools: {
+        totalEnabled: number;
+        missing: string[];
+    };
+    mcpClients: {
+        totalServeProcesses: number;
+        clientGroups: McpClientGroup[];
+        untaggedPids: number[];
+        heuristicCandidates: HeuristicCandidate[];
+    };
+    debtSummary: RulesDebtSummary | null;
+    fixes: string[];
+};
+//# sourceMappingURL=status-doctor.d.ts.map

package/dist/cli/mcp/schemas/status-doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-doctor.d.ts","sourceRoot":"","sources":["../../../../src/cli/mcp/schemas/status-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAEjG,MAAM,MAAM,eAAe,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,KAAK,CAAC,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG;IAClD,MAAM,EAAE,qBAAqB,GAAG,6BAA6B,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC;AAEnF,MAAM,MAAM,eAAe,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE;QACH,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,OAAO,CAAC;QACnB;;;WAGG;QACH,QAAQ,EAAE,OAAO,CAAC;QAClB,6EAA6E;QAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,GAAG,EAAE;QACJ,OAAO,EAAE,OAAO,CAAC;QACjB,kFAAkF;QAClF,MAAM,EAAE,MAAM,CAAC;QACf,0EAA0E;QAC1E,QAAQ,EAAE,OAAO,CAAC;KAClB,CAAC;IACF,OAAO,EAAE;QACR,eAAe,EAAE,OAAO,CAAC;QACzB,YAAY,EAAE,OAAO,CAAC;QACtB,KAAK,EAAE,OAAO,CAAC;QACf;;;;WAIG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,SAAS,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAChE,kFAAkF;QAClF,KAAK,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnD,UAAU,EAAE;QACX,mBAAmB,EAAE,MAAM,CAAC;QAC5B,YAAY,EAAE,cAAc,EAAE,CAAC;QAC/B,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;KAC1C,CAAC;IACF,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB,CAAC"}

package/dist/cli/mcp/schemas/status-doctor.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=status-doctor.js.map

package/dist/cli/mcp/schemas/status-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-doctor.js","sourceRoot":"","sources":["../../../../src/cli/mcp/schemas/status-doctor.ts"],"names":[],"mappings":""}

package/dist/cli/mcp/support/host-port.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The managed MCP HTTP host's port is WORKSPACE-SCOPED, not machine-global.
+ *
+ * WHY. Port 3000 was the baked default in four places (the `dev.mcp.serve`,
+ * `dev.mcp.start` and `dev.mcp.status` descriptors, and
+ * `createMcpServerProcessConfig`). Every workspace on a machine therefore asked
+ * for the SAME port, which made "port busy" the normal state on a shared box
+ * and made PM's conflict handling load-bearing for correctness. Measured
+ * 2026-08-30/31: a scratch PM daemon in a throwaway `VIBES_HOME` found port
+ * 3000 held by a peer lane's `vibes dev mcp serve --mode http --port 3000` and
+ * killed it — three times in one day. The kill is fixed in
+ * `@vibesdotdev/pm/utils/port-ownership`; this removes the collision that asked
+ * the question.
+ *
+ * WHERE THE DERIVATION LIVES. The pure Paths workspace-mcp-host contract uses
+ * portable Shared hashing. `@vibesdotdev/tools` writes the local MCP URL into every external client
+ * config and builds a per-hook-call MCP client, so it must compute the identical
+ * port; `mcp` already depends on `tools`, so the dependency can only run the
+ * other way. Moving the derivation down to the layer both already depend on is
+ * what keeps ONE definition of "which port does this workspace's host own".
+ * This module stays as the MCP-side name for it, so existing call sites and the
+ * doc trail above are unchanged.
+ *
+ * OVERRIDES, most specific first:
+ *   1. an explicit `--port` (a user asking for a port always gets that port);
+ *   2. `VIBES_MCP_PORT` in the environment;
+ *   3. the workspace derivation.
+ * There is no path back to a machine-global constant.
+ */
+export { MCP_HOST_PORT_RANGE_START, MCP_HOST_PORT_RANGE_SIZE, parsePortValue, deriveWorkspaceMcpPort, resolveMcpHostPort, type ResolveMcpHostPortInput } from '@vibesdotdev/paths/workspace-mcp-host';
+//# sourceMappingURL=host-port.d.ts.map

package/dist/cli/mcp/support/host-port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-port.d.ts","sourceRoot":"","sources":["../../../../src/cli/mcp/support/host-port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACN,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,uBAAuB,EAC5B,MAAM,uCAAuC,CAAC"}

package/dist/cli/mcp/support/host-port.js

@@ -0,0 +1,31 @@
+/**
+ * The managed MCP HTTP host's port is WORKSPACE-SCOPED, not machine-global.
+ *
+ * WHY. Port 3000 was the baked default in four places (the `dev.mcp.serve`,
+ * `dev.mcp.start` and `dev.mcp.status` descriptors, and
+ * `createMcpServerProcessConfig`). Every workspace on a machine therefore asked
+ * for the SAME port, which made "port busy" the normal state on a shared box
+ * and made PM's conflict handling load-bearing for correctness. Measured
+ * 2026-08-30/31: a scratch PM daemon in a throwaway `VIBES_HOME` found port
+ * 3000 held by a peer lane's `vibes dev mcp serve --mode http --port 3000` and
+ * killed it — three times in one day. The kill is fixed in
+ * `@vibesdotdev/pm/utils/port-ownership`; this removes the collision that asked
+ * the question.
+ *
+ * WHERE THE DERIVATION LIVES. The pure Paths workspace-mcp-host contract uses
+ * portable Shared hashing. `@vibesdotdev/tools` writes the local MCP URL into every external client
+ * config and builds a per-hook-call MCP client, so it must compute the identical
+ * port; `mcp` already depends on `tools`, so the dependency can only run the
+ * other way. Moving the derivation down to the layer both already depend on is
+ * what keeps ONE definition of "which port does this workspace's host own".
+ * This module stays as the MCP-side name for it, so existing call sites and the
+ * doc trail above are unchanged.
+ *
+ * OVERRIDES, most specific first:
+ *   1. an explicit `--port` (a user asking for a port always gets that port);
+ *   2. `VIBES_MCP_PORT` in the environment;
+ *   3. the workspace derivation.
+ * There is no path back to a machine-global constant.
+ */
+export { MCP_HOST_PORT_RANGE_START, MCP_HOST_PORT_RANGE_SIZE, parsePortValue, deriveWorkspaceMcpPort, resolveMcpHostPort } from '@vibesdotdev/paths/workspace-mcp-host';
+//# sourceMappingURL=host-port.js.map

package/dist/cli/mcp/support/host-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-port.js","sourceRoot":"","sources":["../../../../src/cli/mcp/support/host-port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EACN,yBAAyB,EACzB,wBAAwB,EACxB,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAElB,MAAM,uCAAuC,CAAC"}

package/dist/cli/mcp/support/server-process.impl.consumer.d.ts

@@ -0,0 +1,24 @@
+import type { ProcessConfigInput } from '@vibesdotdev/pm/schemas/process';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+export declare const MCP_SERVER_PROCESS_ID = "mcp-server-dev";
+export declare const LEGACY_MCP_SERVER_PROCESS_ID = "mcp-server";
+export type McpServerProcessRuntime = Pick<RuntimeRef, 'hasKind' | 'query' | 'getEnvSnapshot' | 'context'>;
+/** IDs belong to the bound MCP root inside the daemon admitted by PM. */
+export declare function mcpServerProcessId(runtime: Pick<RuntimeRef, 'context'>, workspaceRoot: string): Promise<string>;
+/** Legacy reads are confined to the admitted root; never address its host from a nested root. */
+export declare function mcpServerProcessIds(runtime: Pick<RuntimeRef, 'context'>, workspaceRoot: string): Promise<string[]>;
+export declare function createMcpServerProcessConfig(options: {
+    /** The runtime the command was handed: its host declares the self-spawn command PM re-enters. */
+    runtime: McpServerProcessRuntime;
+    mode?: 'stdio' | 'http';
+    port?: string;
+    authDisabled?: boolean;
+    /**
+     * The workspace this managed host belongs to: the caller's bound workspace
+     * (`runtime/workspace-path`). It sets `cwd`, `VIBES_WORKSPACE` AND the
+     * derived port, so all three describe the same scope. Nothing here falls
+     * back to an environment variable or the process cwd.
+     */
+    workspaceRoot: string;
+}): Promise<ProcessConfigInput>;
+//# sourceMappingURL=server-process.impl.consumer.d.ts.map

package/dist/cli/mcp/support/server-process.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-process.impl.consumer.d.ts","sourceRoot":"","sources":["../../../../src/cli/mcp/support/server-process.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAA2C,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG/F,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AACtD,eAAO,MAAM,4BAA4B,eAAe,CAAC;AAEzD,MAAM,MAAM,uBAAuB,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAE3G,yEAAyE;AACzE,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMrH;AAED,iGAAiG;AACjG,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAGxH;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE;IAC3D,iGAAiG;IACjG,OAAO,EAAE,uBAAuB,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;CACtB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA8D9B"}

package/dist/cli/mcp/support/server-process.impl.consumer.js

@@ -0,0 +1,86 @@
+import { admittedWorkspaceIdentity, requireAdmittedWorkspace } from '@vibesdotdev/pm/admission';
+import { CapabilityError, getRuntimeHostCommands } from '@vibesdotdev/kernel';
+import { resolveMcpHostPort } from "./host-port.js";
+export const MCP_SERVER_PROCESS_ID = 'mcp-server-dev';
+export const LEGACY_MCP_SERVER_PROCESS_ID = 'mcp-server';
+/** IDs belong to the bound MCP root inside the daemon admitted by PM. */
+export async function mcpServerProcessId(runtime, workspaceRoot) {
+    const admitted = await requireAdmittedWorkspace(runtime);
+    const workspace = admittedWorkspaceIdentity(workspaceRoot);
+    return workspace.workspacePath === admittedWorkspaceIdentity(admitted.root).workspacePath
+        ? MCP_SERVER_PROCESS_ID
+        : `${MCP_SERVER_PROCESS_ID}-${workspace.toolingId}`;
+}
+/** Legacy reads are confined to the admitted root; never address its host from a nested root. */
+export async function mcpServerProcessIds(runtime, workspaceRoot) {
+    const id = await mcpServerProcessId(runtime, workspaceRoot);
+    return id === MCP_SERVER_PROCESS_ID ? [id, LEGACY_MCP_SERVER_PROCESS_ID] : [id];
+}
+export async function createMcpServerProcessConfig(options) {
+    const mode = options.mode ?? 'http';
+    const workspaceRoot = options.workspaceRoot;
+    // No machine-global default. Absent an explicit --port this is the port THIS
+    // workspace owns, so two lanes on one machine never contend. See host-port.ts.
+    const port = String(resolveMcpHostPort({ explicitPort: options.port, workspaceRoot, env: options.runtime.getEnvSnapshot() }));
+    const env = {
+        VIBES_WORKSPACE: workspaceRoot,
+        MCP_LOG_LEVEL: 'info'
+    };
+    if (options.authDisabled) {
+        env.MCP_AUTH_ENABLED = 'false';
+    }
+    const hostCommands = await getRuntimeHostCommands(options.runtime);
+    const [command, ...hostArgs] = hostCommands.selfSpawnArgv('MCP server process');
+    return {
+        id: await mcpServerProcessId(options.runtime, workspaceRoot),
+        name: 'MCP Server Dev',
+        command,
+        args: [
+            ...hostArgs,
+            '--workspace-root',
+            workspaceRoot,
+            'dev',
+            'mcp',
+            'serve',
+            '--mode',
+            mode,
+            '--port',
+            port
+        ],
+        cwd: workspaceRoot,
+        env,
+        autoRestart: mode === 'http',
+        codeUpdatePolicy: 'runtime',
+        restartDelay: mode === 'http' ? 5000 : 1000,
+        maxRestarts: mode === 'http' ? 10 : 0,
+        healthCheck: mode === 'http'
+            ? {
+                type: 'http',
+                failureAction: 'report',
+                endpoint: `http://127.0.0.1:${normalizePort(port)}/health`,
+                interval: 10000,
+                timeout: 3000,
+                retries: 5,
+                // Measured 2026-09-05: boot-to-bind on the dirty developer tree
+                // is 32-43 s; a 15 s warmup + 30 s grace had PM SIGKILL hosts
+                // that were still loading (7 warmup-ended, 12 force-kills that
+                // day). Warm for two minutes, then a full minute of grace.
+                warmupMs: 120000,
+                gracePeriodMultiplier: 6
+            }
+            : undefined,
+        tags: mode === 'http' ? ['infrastructure', 'mcp'] : ['mcp', 'server', 'stdio'],
+        dependencies: mode === 'http' ? [] : undefined,
+        presets: mode === 'http' ? ['dev', 'full'] : undefined
+    };
+}
+/** The port the config already resolved (always a positive integer by construction). */
+function normalizePort(port) {
+    const parsed = Number.parseInt(port, 10);
+    if (Number.isFinite(parsed) && parsed > 0)
+        return parsed;
+    throw new CapabilityError(`MCP server port '${port}' is not a positive integer.`, 'INVALID_INPUT', {
+        reason: 'mcp-port-invalid'
+    });
+}
+//# sourceMappingURL=server-process.impl.consumer.js.map

package/dist/cli/mcp/support/server-process.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-process.impl.consumer.js","sourceRoot":"","sources":["../../../../src/cli/mcp/support/server-process.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAEhG,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAmB,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AACtD,MAAM,CAAC,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAIzD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoC,EAAE,aAAqB;IACnG,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,yBAAyB,CAAC,aAAa,CAAC,CAAC;IAC3D,OAAO,SAAS,CAAC,aAAa,KAAK,yBAAyB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,aAAa;QACxF,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,GAAG,qBAAqB,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAoC,EAAE,aAAqB;IACpG,MAAM,EAAE,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC5D,OAAO,EAAE,KAAK,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAalD;IACA,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC;IACpC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,IAAI,GAAG,MAAM,CAClB,kBAAkB,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CACxG,CAAC;IACF,MAAM,GAAG,GAA2C;QACnD,eAAe,EAAE,aAAa;QAC9B,aAAa,EAAE,MAAM;KACrB,CAAC;IAEF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC;IAChC,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,YAAY,CAAC,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAEhF,OAAO;QACN,EAAE,EAAE,MAAM,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC;QAC5D,IAAI,EAAE,gBAAgB;QACtB,OAAO;QACP,IAAI,EAAE;YACL,GAAG,QAAQ;YACX,kBAAkB;YAClB,aAAa;YACb,KAAK;YACL,KAAK;YACL,OAAO;YACP,QAAQ;YACR,IAAI;YACJ,QAAQ;YACR,IAAI;SACJ;QACD,GAAG,EAAE,aAAa;QAClB,GAAG;QACH,WAAW,EAAE,IAAI,KAAK,MAAM;QAC5B,gBAAgB,EAAE,SAAS;QAC3B,YAAY,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;QAC3C,WAAW,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrC,WAAW,EACV,IAAI,KAAK,MAAM;YACd,CAAC,CAAC;gBACA,IAAI,EAAE,MAAM;gBACZ,aAAa,EAAE,QAAQ;gBACvB,QAAQ,EAAE,oBAAoB,aAAa,CAAC,IAAI,CAAC,SAAS;gBAC1D,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;gBACV,gEAAgE;gBAChE,8DAA8D;gBAC9D,+DAA+D;gBAC/D,2DAA2D;gBAC3D,QAAQ,EAAE,MAAM;gBAChB,qBAAqB,EAAE,CAAC;aACxB;YACF,CAAC,CAAC,SAAS;QACb,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;QAC9E,YAAY,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAC9C,OAAO,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;KACtD,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACzD,MAAM,IAAI,eAAe,CAAC,oBAAoB,IAAI,8BAA8B,EAAE,eAAe,EAAE;QAClG,MAAM,EAAE,kBAAkB;KAC1B,CAAC,CAAC;AACJ,CAAC"}

package/dist/cli/mcp/support/status-doctor.d.ts

@@ -0,0 +1,33 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { RuntimeProcessService } from '@vibesdotdev/kernel/process';
+import { PMClient } from '@vibesdotdev/pm/client';
+import type { McpDoctorReport, McpServeProcess } from '../schemas/status-doctor.ts';
+import { type McpServerProcessRuntime } from './server-process.impl.consumer.ts';
+export declare function resolveMcpServerStatus(pm: PMClient, options: {
+    runtime: Pick<VibesRuntime, 'context'>;
+    workspaceRoot: string;
+}): Promise<{
+    processId: string | null;
+    status: string;
+    running: boolean;
+}>;
+export declare function ensureCoreToolCoverage(runtime: Pick<VibesRuntime, 'declaredScope' | 'hasKind' | 'assets'>): Promise<{
+    totalEnabled: number;
+    missing: string[];
+}>;
+export declare function ensureMcpServer(pm: PMClient, options: {
+    runtime: McpServerProcessRuntime;
+    mode?: 'stdio' | 'http';
+    port?: string;
+    workspaceRoot: string;
+}): Promise<void>;
+export declare function createMcpClientReport(processes: McpServeProcess[]): McpDoctorReport['mcpClients'];
+/**
+ * Signal each duplicate stdio client through the handed runtime's process
+ * service. A failed signal is reported per pid by its value-free facts.
+ */
+export declare function cleanupDuplicateClientProcesses(processService: Pick<RuntimeProcessService, 'signal'>, processes: McpServeProcess[]): Promise<{
+    terminated: number[];
+    failed: string[];
+}>;
+//# sourceMappingURL=status-doctor.d.ts.map

package/dist/cli/mcp/support/status-doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-doctor.d.ts","sourceRoot":"","sources":["../../../../src/cli/mcp/support/status-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAMlD,OAAO,KAAK,EAEX,eAAe,EACf,eAAe,EACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGN,KAAK,uBAAuB,EAC5B,MAAM,mCAAmC,CAAC;AAiB3C,wBAAsB,sBAAsB,CAC3C,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE;IAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACxE,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAazE;AAED,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,eAAe,GAAG,SAAS,GAAG,QAAQ,CAAC,GACjE,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgBtD;AAED,wBAAsB,eAAe,CACpC,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE;IAAE,OAAO,EAAE,uBAAuB,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAC1G,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAgB,qBAAqB,CACpC,SAAS,EAAE,eAAe,EAAE,GAC1B,eAAe,CAAC,YAAY,CAAC,CAU/B;AAED;;;GAGG;AACH,wBAAsB,+BAA+B,CACpD,cAAc,EAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,EACrD,SAAS,EAAE,eAAe,EAAE,GAC1B,OAAO,CAAC;IACV,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAkBD"}

package/dist/cli/mcp/support/status-doctor.js

@@ -0,0 +1,104 @@
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+// Runtime is expected to be initialized by the calling CLI surface / entrypoint.
+import { PMClient } from '@vibesdotdev/pm/client';
+import { toolEligibleForPurpose } from '@vibesdotdev/tools/kinds/tool';
+import { groupMcpServeProcessesByClient, selectDuplicateStdioClientCleanupTargets } from "../management/process-audit.impl.consumer.js";
+import { mcpServerProcessIds, createMcpServerProcessConfig } from "./server-process.impl.consumer.js";
+const REQUIRED_TOOL_IDS = [
+    'workspace-fs',
+    'workspace-search',
+    'workspace-lsp',
+    'workspace-lock',
+    'brain',
+    'presence',
+    'awareness',
+    'knowledge',
+    'session',
+    'session-todo',
+    'session-scratchpad',
+    'vibes-work'
+];
+export async function resolveMcpServerStatus(pm, options) {
+    let fallback = null;
+    for (const processId of await mcpServerProcessIds(options.runtime, options.workspaceRoot)) {
+        const status = await pm.getStatus(processId);
+        if (!status)
+            continue;
+        if (status.status === 'running') {
+            return { processId, status: status.status, running: true };
+        }
+        if (!fallback) {
+            fallback = { processId, status: status.status, running: false };
+        }
+    }
+    return fallback ?? { processId: null, status: 'missing', running: false };
+}
+export async function ensureCoreToolCoverage(runtime) {
+    // Coverage is judged as an MCP host on this hardware would see it: the
+    // tools kind's own rule, evaluated for the `mcp` purpose on the hardware
+    // this host declares. The CLI's declared scope is never patched.
+    const hardware = runtime.declaredScope.hardware;
+    const enabled = runtime.hasKind('tools/tool')
+        ? runtime
+            .assets('tools/tool')
+            .descriptors()
+            .filter((descriptor) => descriptor.enabled !== false && toolEligibleForPurpose(descriptor, 'mcp', hardware))
+        : [];
+    const enabledIds = new Set(enabled.map((descriptor) => descriptor.id));
+    return {
+        totalEnabled: enabled.length,
+        missing: REQUIRED_TOOL_IDS.filter((id) => !enabledIds.has(id))
+    };
+}
+export async function ensureMcpServer(pm, options) {
+    await pm.start(await createMcpServerProcessConfig(options), { wait: true });
+}
+export function createMcpClientReport(processes) {
+    return {
+        totalServeProcesses: processes.length,
+        clientGroups: groupMcpServeProcessesByClient(processes),
+        untaggedPids: processes
+            .filter((processInfo) => processInfo.clientId === null)
+            .map((processInfo) => processInfo.pid)
+            .sort((a, b) => a - b),
+        heuristicCandidates: getMcpClientHeuristicCandidates(processes)
+    };
+}
+/**
+ * Signal each duplicate stdio client through the handed runtime's process
+ * service. A failed signal is reported per pid by its value-free facts.
+ */
+export async function cleanupDuplicateClientProcesses(processService, processes) {
+    const targets = selectDuplicateStdioClientCleanupTargets(processes);
+    const terminated = [];
+    const failed = [];
+    for (const target of targets) {
+        for (const pid of target.killPids) {
+            const result = await processService.signal(pid, 'SIGTERM').then(() => ({ ok: true }), error => ({ ok: false, error: CaughtFailureSchema.parse(error) }));
+            if (result.ok)
+                terminated.push(pid);
+            else {
+                const facts = valueFreeFailure(result.error);
+                failed.push(`${pid}:${facts.code ?? facts.name}`);
+            }
+        }
+    }
+    return { terminated, failed };
+}
+function getMcpClientHeuristicCandidates(processes) {
+    const candidates = [];
+    for (const processInfo of processes) {
+        if (processInfo.mode !== 'stdio')
+            continue;
+        const elapsed = processInfo.elapsedSeconds ?? 0;
+        if (processInfo.clientId !== null && processInfo.ppid === 1) {
+            candidates.push({ ...processInfo, reason: 'orphan-stdio-client' });
+            continue;
+        }
+        if (processInfo.clientId === null && elapsed >= 300) {
+            candidates.push({ ...processInfo, reason: 'untagged-stdio-long-running' });
+        }
+    }
+    return candidates.sort((a, b) => a.pid - b.pid);
+}
+//# sourceMappingURL=status-doctor.js.map

package/dist/cli/mcp/support/status-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-doctor.js","sourceRoot":"","sources":["../../../../src/cli/mcp/support/status-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAqB,MAAM,qBAAqB,CAAC;AAE/F,iFAAiF;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACN,8BAA8B,EAC9B,wCAAwC,EACxC,MAAM,8CAA8C,CAAC;AAMtD,OAAO,EACN,mBAAmB,EACnB,4BAA4B,EAE5B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,iBAAiB,GAAG;IACzB,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,OAAO;IACP,UAAU;IACV,WAAW;IACX,WAAW;IACX,SAAS;IACT,cAAc;IACd,oBAAoB;IACpB,YAAY;CACZ,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,EAAY,EACZ,OAA0E;IAE1E,IAAI,QAAQ,GAAmE,IAAI,CAAC;IACpF,KAAK,MAAM,SAAS,IAAI,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC3F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAAmE;IAEnE,uEAAuE;IACvE,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;QAC5C,CAAC,CAAC,OAAO;aACN,MAAM,CAAC,YAAY,CAAC;aACpB,WAAW,EAAE;aACb,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,KAAK,KAAK,IAAI,sBAAsB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC9G,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO;QACN,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;KAC9D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,EAAY,EACZ,OAA4G;IAE5G,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,4BAA4B,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,SAA4B;IAE5B,OAAO;QACN,mBAAmB,EAAE,SAAS,CAAC,MAAM;QACrC,YAAY,EAAE,8BAA8B,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,SAAS;aACrB,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,KAAK,IAAI,CAAC;aACtD,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;aACrC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,mBAAmB,EAAE,+BAA+B,CAAC,SAAS,CAAC;KAC/D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,cAAqD,EACrD,SAA4B;IAK5B,MAAM,OAAO,GAAG,wCAAwC,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,IAAI,CAC9D,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC,EAC7B,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAC1E,CAAC;YACF,IAAI,MAAM,CAAC,EAAE;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;iBAC/B,CAAC;gBACL,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,+BAA+B,CAAC,SAA4B;IACpE,MAAM,UAAU,GAAyB,EAAE,CAAC;IAC5C,KAAK,MAAM,WAAW,IAAI,SAAS,EAAE,CAAC;QACrC,IAAI,WAAW,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QAC3C,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,IAAI,CAAC,CAAC;QAChD,IAAI,WAAW,CAAC,QAAQ,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7D,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACnE,SAAS;QACV,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACrD,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;AACjD,CAAC"}

package/dist/cli/print.d.ts

@@ -0,0 +1,12 @@
+/**
+ * CLI text output through the handed runtime's host stdio (`runtime/stdio`),
+ * never the process streams. Text that came from somewhere else (an installer
+ * result, a descriptor, a remote error) is passed through {@link untrustedText}
+ * first, so a credential it echoes never reaches the terminal.
+ */
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+/** Write `text` followed by a newline to the runtime's stdout or stderr. */
+export declare function printLine(runtime: Pick<RuntimeRef, 'hasKind' | 'registerPlugin' | 'query'>, text: string, channel?: 'stdout' | 'stderr'): Promise<void>;
+/** An untrusted fragment as a CLI line may carry it: control characters and credentials removed, bounded. */
+export declare function untrustedText(text: string): string;
+//# sourceMappingURL=print.d.ts.map

package/dist/cli/print.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"print.d.ts","sourceRoot":"","sources":["../../src/cli/print.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAOvE,4EAA4E;AAC5E,wBAAsB,SAAS,CAC9B,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,gBAAgB,GAAG,OAAO,CAAC,EACjE,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,QAAQ,GAAG,QAAmB,GACrC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,6GAA6G;AAC7G,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD"}

package/dist/cli/print.js

@@ -0,0 +1,25 @@
+/**
+ * CLI text output through the handed runtime's host stdio (`runtime/stdio`),
+ * never the process streams. Text that came from somewhere else (an installer
+ * result, a descriptor, a remote error) is passed through {@link untrustedText}
+ * first, so a credential it echoes never reaches the terminal.
+ */
+import { getRuntimeStdio } from '@vibesdotdev/kernel';
+import { redactedExcerpt } from '@vibesdotdev/shared/utils';
+import { writeStdout } from '@vibesdotdev/cli/output';
+/** The most characters of one untrusted fragment a CLI line prints. */
+const UNTRUSTED_TEXT_MAX_CHARS = 2000;
+/** Write `text` followed by a newline to the runtime's stdout or stderr. */
+export async function printLine(runtime, text, channel = 'stdout') {
+    // stdout is the command's output: the cli owner joins the host's output plane.
+    if (channel === 'stdout') {
+        await writeStdout(runtime, `${text}\n`);
+        return;
+    }
+    (await getRuntimeStdio(runtime)).write('stderr', `${text}\n`);
+}
+/** An untrusted fragment as a CLI line may carry it: control characters and credentials removed, bounded. */
+export function untrustedText(text) {
+    return redactedExcerpt(text, { maxChars: UNTRUSTED_TEXT_MAX_CHARS });
+}
+//# sourceMappingURL=print.js.map

package/dist/cli/print.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"print.js","sourceRoot":"","sources":["../../src/cli/print.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,uEAAuE;AACvE,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,OAAiE,EACjE,IAAY,EACZ,UAA+B,QAAQ;IAEvC,+EAA+E;IAC/E,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;QACxC,OAAO;IACR,CAAC;IACD,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,aAAa,CAAC,IAAY;IACzC,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/cli/surface-mcp/client-connection-identity.consumer.d.ts

@@ -0,0 +1,19 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type ServeIdentity } from '../../adapters/mcp/serve-identity.ts';
+export interface ClientConnectionIdentity {
+    readonly agentId?: string;
+    readonly harness: string;
+    readonly agentSystemId?: string;
+    readonly harnessSessionId?: string;
+    readonly projectIds: readonly string[];
+    /** The owner this agent calls home (`VIBES_AGENT_HOME`); ids come from the principal. */
+    readonly home?: AgentHome;
+}
+type AgentHome = 'user' | 'organization' | 'team';
+export declare function resolveClientConnectionIdentity(runtime: RuntimeRef, input: {
+    identity: ServeIdentity;
+    env: Record<string, string | undefined>;
+    workspaceRoot: string;
+}): Promise<ClientConnectionIdentity>;
+export {};
+//# sourceMappingURL=client-connection-identity.consumer.d.ts.map

package/dist/cli/surface-mcp/client-connection-identity.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-connection-identity.consumer.d.ts","sourceRoot":"","sources":["../../../src/cli/surface-mcp/client-connection-identity.consumer.ts"],"names":[],"mappings":"AAYA,OAAO,EAA+C,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAE/F,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,yFAAyF;IACzF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC1B;AAED,KAAK,SAAS,GAAG,MAAM,GAAG,cAAc,GAAG,MAAM,CAAC;AAElD,wBAAsB,+BAA+B,CACpD,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE;IACP,QAAQ,EAAE,aAAa,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;CACrB,GACC,OAAO,CAAC,wBAAwB,CAAC,CAoBnC"}

package/dist/cli/surface-mcp/client-connection-identity.consumer.js

@@ -0,0 +1,53 @@
+/**
+ * The identity a stdio MCP client declares for its connection, resolved at the
+ * CLI boundary where reading this process's env and checkout is legitimate:
+ * this process was spawned by exactly one harness for exactly one agent.
+ *
+ * A relay sends it on `initialize` with the shared host's local attestation
+ * (verified there as `mcp-relay-launch`); an isolated stdio server hands it to
+ * the adapter as its `verifiedConnectionIdentity` (`stdio-launch`). The shared
+ * host never computes it.
+ */
+import { resolveProjectRefContext } from '@vibesdotdev/workspace/project-ref';
+import { getLogger } from '@vibesdotdev/logging';
+import { isCapabilityError, settle, valueFreeFailure } from '@vibesdotdev/kernel';
+import { findHarnessIdentity } from "../../adapters/mcp/serve-identity.js";
+export async function resolveClientConnectionIdentity(runtime, input) {
+    const { readHarnessSessionIdFromEnv } = await import('@vibesdotdev/session/mcp/utils/participant');
+    // A harness whose descriptor declares a `per-process` session id launches
+    // one MCP server per process (Codex today). A shared agent slug or an
+    // inherited conversation id would hand every lane the orchestrator's seat.
+    // Keep this launch id in the relay identity so host reconnects retain it.
+    // Every other harness keeps its declared conversation continuity from env.
+    const harnessSessionId = findHarnessIdentity(runtime, input.identity.harness)?.sessionId?.source === 'per-process'
+        ? `${input.identity.harness}-mcp-${crypto.randomUUID()}`
+        : readHarnessSessionIdFromEnv(runtime, input.env);
+    return {
+        harness: input.identity.harness,
+        projectIds: await checkoutProjectIds(runtime, input.workspaceRoot),
+        agentId: input.identity.agent || undefined,
+        agentSystemId: input.identity.agentSystemId || undefined,
+        harnessSessionId: harnessSessionId || undefined,
+        home: declaredHome(input.env)
+    };
+}
+function declaredHome(env) {
+    const value = env.VIBES_AGENT_HOME?.trim();
+    if (value === 'user' || value === 'organization' || value === 'team')
+        return value;
+    return undefined;
+}
+async function checkoutProjectIds(runtime, workspaceRoot) {
+    // Through the owner's context: it activates this host's synchronous filesystem first.
+    const read = await settle(async () => (await resolveProjectRefContext(runtime)).resolve({ workspaceRoot }));
+    if (read.ok)
+        return read.value ? [read.value.projectId] : [];
+    // A refused marker (symlink or non-file) leaves this checkout unbound.
+    // Every other failure still propagates.
+    if (isCapabilityError(read.cause) && read.cause.reason === 'project-ref-marker-refused') {
+        getLogger('mcp', runtime).debug('checkout ProjectRef marker refused', { failure: valueFreeFailure(read.cause) });
+        return [];
+    }
+    throw read.cause;
+}
+//# sourceMappingURL=client-connection-identity.consumer.js.map

package/dist/cli/surface-mcp/client-connection-identity.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-connection-identity.consumer.js","sourceRoot":"","sources":["../../../src/cli/surface-mcp/client-connection-identity.consumer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAsB,MAAM,sCAAsC,CAAC;AAc/F,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,OAAmB,EACnB,KAIC;IAED,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CACnD,4CAA4C,CAC5C,CAAC;IACF,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,KAAK,aAAa;QACjH,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,QAAQ,MAAM,CAAC,UAAU,EAAE,EAAE;QACxD,CAAC,CAAC,2BAA2B,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO;QACN,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;QAC/B,UAAU,EAAE,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC;QAClE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK,IAAI,SAAS;QAC1C,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,aAAa,IAAI,SAAS;QACxD,gBAAgB,EAAE,gBAAgB,IAAI,SAAS;QAC/C,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;KACM,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,GAAuC;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACnF,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAmB,EAAE,aAAqB;IAC3E,sFAAsF;IACtF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAC5G,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,uEAAuE;IACvE,wCAAwC;IACxC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,4BAA4B,EAAE,CAAC;QACzF,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACjH,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,IAAI,CAAC,KAAK,CAAC;AAClB,CAAC"}

package/dist/cli/surface-mcp/dev.mcp.serve.impl.cloud.d.ts

@@ -0,0 +1,7 @@
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+declare function executeMcpCommand(_args: CommandOptions, options: CommandOptions, context: CommandContext): Promise<void>;
+declare const _default: import("@vibesdotdev/kernel").RuntimeImplementationWrapper<{
+    execute: typeof executeMcpCommand;
+}>;
+export default _default;
+//# sourceMappingURL=dev.mcp.serve.impl.cloud.d.ts.map

package/dist/cli/surface-mcp/dev.mcp.serve.impl.cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev.mcp.serve.impl.cloud.d.ts","sourceRoot":"","sources":["../../../src/cli/surface-mcp/dev.mcp.serve.impl.cloud.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAyDvE,iBAAe,iBAAiB,CAC/B,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CA6Tf;;;;AAED,wBAKG"}