@vibesdotdev/mcp 0.0.0-stage → 1.0.0-rc.1

package/dist/adapters/mcp/tool-audit-live.js

@@ -0,0 +1,538 @@
+import { loadPurposePresetOverrides } from '@vibesdotdev/tools/config/load';
+import { runtimePurposePresets } from '@vibesdotdev/tools/schemas/presets/registry';
+/**
+ * Wire Selfie — the live half of the tool-exposure audit (czar cycle).
+ *
+ * Spawns the REAL stdio MCP server for a client preset, performs the real
+ * initialize → initialized → tools/list handshake over JSON-RPC, and diffs what
+ * the wire SERVES against what the registry AUTHORS. This is the only instrument
+ * that catches serve-world truth the static/policy views structurally cannot:
+ * tools selected by policy but absent from the wire (registration failure or
+ * serve-world zombie — the brain outage class), served schemas laundered to
+ * empty `{}`, property loss, and stale served bodies whose descriptions the
+ * current source cannot produce.
+ *
+ * Consumer-only (spawns processes). Capture and diff are separated so the diff
+ * is pure and unit-testable. See docs/proposals/universal-tools-czar/ (L5).
+ */
+import * as z from 'zod/v4';
+import { CallToolResultSchema } from '@modelcontextprotocol/sdk/types.js';
+import { CapabilityError, composeHostEnv, isCapabilityError, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { JsonObjectSchema } from '@vibesdotdev/kernel/schemas/json';
+import { getLogger } from '@vibesdotdev/logging';
+import { getRuntimeExecution } from '@vibesdotdev/kernel/execution';
+import { isLifecycleDeadline } from '@vibesdotdev/kernel-rpc';
+import { toRuntimeJsonSchema } from '@vibesdotdev/kernel/schemas/json-schema';
+import { flattenDiscriminatedUnionToObject, resolveMcpDescription } from "../zod-mcp.js";
+import { selectMcpTools } from "./tool-selection.js";
+import { isLocalToolId, localToolsOf } from '@vibesdotdev/tools/local/node/ensure-local-tools';
+import { formatLocalMcpToolDescription } from "./local-origin.js";
+import { resolveProjectionBirthMetadata } from "./projection.js";
+import { JsonRpcMessageSchema, RpcRejectionSchema, ToolsListResultSchema } from "../../schemas/audit.js";
+/**
+ * Catalog ceiling in REAL wire bytes for one client's `tools/list`. THE catalog
+ * budget — there is deliberately no second one (see tool-audit.ts, where a
+ * description-based budget was removed by ruling on 2026-07-25).
+ *
+ * Descriptions are not the catalog. Measured live 2026-07-24:
+ *
+ *   base `mcp` (67 tools)   descriptions   4,984 B (3.1%)   TOTAL 162,238 B ~45K tok
+ *   `mcp:claude` (75 tools) descriptions  ~9,129 B (4.1%)   TOTAL 224,730 B ~62K tok
+ *
+ * The retired description budget read 1,621/24,000 "healthy" for `mcp:claude`
+ * while that client actually paid ~62K tokens per request. `inputSchema` is the
+ * rest, and only a measurement taken ON THE WIRE sees it — hence the Wire Selfie,
+ * not the policy view.
+ *
+ * The cost is concentrated, not spread: `awareness` alone is 38,473 B — 17% of the
+ * whole `mcp:claude` catalog in ONE tool — behind a description of a few dozen
+ * chars. Then browser 12,020B, workspace-fs 10,840B, knowledge 10,016B, presence
+ * 6,331B. A short description is not a small tool; a wide action union is the cost.
+ *
+ * WHERE THE BYTES ACTUALLY ARE — measured on the `cursor` wire 2026-07-25, after the
+ * awareness flattening landed (204,965 B / 75 tools):
+ *
+ *   inputSchema   93,294 B  45.5%
+ *   outputSchema  71,172 B  34.7%   ← 57 of 75 tools carry one
+ *   _meta         14,577 B   7.1%
+ *   description    7,486 B   3.7%
+ *   annotations    6,725 B   3.3%
+ *
+ * A THIRD of the catalog is `outputSchema`, and an earlier version of this comment
+ * said the non-description remainder was `inputSchema` — naming one of the two real
+ * costs and omitting the other. That sent a full session's optimization at the input
+ * side: for `awareness` (18,253 B) the output schema is 10,848 B, 59% of the tool;
+ * `presence` 78%, `applet` 76%, `vibes-work` 68%. Flattening their action unions
+ * cannot reach those bytes. THAT IS WHY `ServedTool.parts` exists — a budget that
+ * reports a total without its composition prescribes the wrong fix, confidently.
+ *
+ * `outputSchema` is not dead weight, and this is not a recommendation to drop it: the
+ * SDK validates every result against the REGISTERED schema object
+ * (`server/mcp.js` `validateToolOutput`), and emits the wire copy from that same
+ * object in the `tools/list` projection — two independent reads. Suppressing the wire
+ * copy per client policy would keep the validation and drop the bytes; that is a real
+ * decision for whoever owns client policy, not something this comment decides.
+ *
+ * `$defs`/`$ref` is NOT the lever people reach for first: measured on the same wire,
+ * every byte-identical repeated sub-schema across all 75 tools totals 8,145 B (4.0%),
+ * and the property-level subset a normal emitter would catch is 2,758 B (1.3%).
+ *
+ * 200,000 bytes ~55K tokens. This FIRES TODAY for the continuity presets
+ * (`mcp:claude` at 224,730) and passes for base `mcp` at 162,238 — deliberately, and
+ * stated here because an earlier draft of this comment claimed it would not fire on
+ * arrival, which was true only for the preset I had measured. The finding is `medium`
+ * and does not fail the audit, so it reports real pressure without breaking a gate.
+ * When it trips, the first question is whether that tool's action union should be
+ * split or deferred — not whether the number should go up.
+ */
+export const WIRE_CATALOG_BUDGET_BYTES = 200_000;
+function asJsonObject(value) {
+    const parsed = JsonObjectSchema.safeParse(value);
+    return parsed.success ? parsed.data : undefined;
+}
+function isStringValue(value) {
+    return typeof value === 'string';
+}
+function isToolAsset(value) {
+    return typeof value === 'object' && value !== null && 'id' in value && 'schemas' in value;
+}
+function rejectRpc(code) {
+    return new CapabilityError('the MCP child rejected the request', 'INTERNAL', {
+        reason: 'mcp-wire-rejected',
+        details: { code }
+    });
+}
+function rpcRejectionCode(error) {
+    if (!isCapabilityError(error) || error.reason !== 'mcp-wire-rejected')
+        return undefined;
+    const parsed = RpcRejectionSchema.safeParse(error.details);
+    return parsed.success ? parsed.data.code : undefined;
+}
+const DEFAULT_TIMEOUT_MS = 180_000;
+/** Grace for the additive post-initialized re-selection before listing. */
+const LIST_SETTLE_MS = 1_500;
+/**
+ * Spawn the real serve and photograph tools/list. Throws on timeout/handshake
+ * failure — a wire that can't answer IS the finding, never a silent pass.
+ */
+export async function captureWireSelfie(options) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const root = options.cwd;
+    const command = options.command;
+    const lifecycle = options.runtime.lifecycle;
+    const startedAt = Date.now();
+    const [cmd, ...cmdArgs] = command;
+    if (!cmd)
+        throw new Error('Wire Selfie: MCP serve command is empty');
+    const proc = await (await getRuntimeExecution(options.runtime)).spawn({
+        command: cmd,
+        args: cmdArgs,
+        cwd: root,
+        env: composeHostEnv(options.runtime),
+        envMode: 'replace',
+        stdin: 'pipe',
+        stdout: 'pipe',
+        stderr: 'ignore'
+    });
+    if (!proc.stdin || !proc.stdout) {
+        await proc.kill();
+        throw new Error('Wire Selfie: the execution provider returned no stdio pipes for the MCP serve child');
+    }
+    const stdin = proc.stdin.getWriter();
+    const stdout = proc.stdout.getReader();
+    const encoder = new TextEncoder();
+    const pending = new Map();
+    let sawListChanged = false;
+    let nextId = 1;
+    const readerDone = (async () => {
+        const decoder = new TextDecoder();
+        let buffer = '';
+        for (;;) {
+            const { done, value: chunk } = await stdout.read();
+            if (done)
+                break;
+            buffer += decoder.decode(chunk, { stream: true });
+            let newline = buffer.indexOf('\n');
+            while (newline >= 0) {
+                const line = buffer.slice(0, newline).trim();
+                buffer = buffer.slice(newline + 1);
+                newline = buffer.indexOf('\n');
+                if (!line.startsWith('{'))
+                    continue;
+                const parsedLine = settleNow(() => JsonRpcMessageSchema.parse(JSON.parse(line)));
+                if (!parsedLine.ok) {
+                    getLogger('mcp', options.runtime).debug('tool audit: non-JSON line from the served child skipped', { failure: valueFreeFailure(parsedLine.cause) });
+                    continue;
+                }
+                const msg = parsedLine.value;
+                if (msg.method === 'notifications/tools/list_changed')
+                    sawListChanged = true;
+                if (msg.id !== undefined && (msg.result !== undefined || msg.error)) {
+                    pending.get(msg.id)?.(msg);
+                    pending.delete(msg.id);
+                }
+            }
+        }
+    })();
+    function send(message) {
+        return stdin.write(encoder.encode(`${JSON.stringify(message)}\n`));
+    }
+    function request(method, params) {
+        const id = nextId++;
+        const deadline = timeoutMs - (Date.now() - startedAt);
+        const response = new Promise((resolve, reject) => {
+            const disarm = lifecycle.timeout(() => {
+                pending.delete(id);
+                reject(new Error(`Wire Selfie: '${method}' timed out (${timeoutMs}ms total budget)`));
+            }, Math.max(deadline, 1));
+            pending.set(id, (msg) => {
+                disarm();
+                if (msg.error)
+                    reject(rejectRpc(msg.error.code));
+                else
+                    resolve(msg);
+            });
+            void settle(async () => {
+                await send({ jsonrpc: '2.0', id, method, params });
+            }).then((sent) => {
+                if (sent.ok)
+                    return;
+                disarm();
+                pending.delete(id);
+                reject(sent.cause);
+            });
+        });
+        const unexpectedExit = proc.exited.then(({ code }) => {
+            throw new Error(`Wire Selfie: MCP child exited with code ${code} before '${method}' responded`);
+        });
+        return Promise.race([response, unexpectedExit]);
+    }
+    try {
+        const initialize = await request('initialize', {
+            protocolVersion: '2025-03-26',
+            capabilities: {},
+            clientInfo: { name: `wire-selfie:${options.clientId}`, version: '1.0.0' }
+        });
+        const initializeResult = asJsonObject(initialize.result);
+        await send({ jsonrpc: '2.0', method: 'notifications/initialized' });
+        let birth;
+        let birthError;
+        const birthAttempt = await settle(() => resolveProjectionBirthMetadata(isStringValue(initializeResult?.instructions) ? initializeResult.instructions : undefined, async (uri) => (await request('resources/read', { uri })).result));
+        if (birthAttempt.ok)
+            birth = birthAttempt.value;
+        else
+            birthError = 'Server birth resource is unavailable or invalid; birth evidence could not be verified';
+        // A settle grace for the additive post-initialized re-selection: the server
+        // signals only a change (list_changed), never "selection complete".
+        await lifecycle.delay(LIST_SETTLE_MS);
+        const served = [];
+        // Re-list once if an additive list_changed lands after our first pass.
+        for (let attempt = 0; attempt < 2; attempt++) {
+            served.length = 0;
+            sawListChanged = false;
+            let cursor;
+            do {
+                const response = await request('tools/list', cursor ? { cursor } : {});
+                const result = ToolsListResultSchema.parse(response.result);
+                for (const tool of result.tools) {
+                    // Measure the entry as the wire carried it, before we project it
+                    // down to property names — this is the only point where the real
+                    // serialized cost is in hand.
+                    const wireBytes = new TextEncoder().encode(JSON.stringify(tool)).byteLength;
+                    const inputSchema = asJsonObject(tool.inputSchema);
+                    const properties = asJsonObject(inputSchema?.properties);
+                    served.push({
+                        name: tool.name,
+                        description: isStringValue(tool.description) ? tool.description : undefined,
+                        inputProperties: properties ? Object.keys(properties).sort() : [],
+                        wireBytes,
+                        parts: splitWireParts(tool, wireBytes)
+                    });
+                }
+                cursor = isStringValue(result?.nextCursor) ? result.nextCursor : undefined;
+            } while (cursor);
+            if (!sawListChanged)
+                break;
+            await lifecycle.delay(LIST_SETTLE_MS);
+        }
+        let canary;
+        if (options.canary) {
+            const { toolId, input } = options.canary;
+            if (!served.some((tool) => tool.name === toolId)) {
+                canary = {
+                    toolId,
+                    status: 'not-served',
+                    failureKind: 'projection',
+                    detail: 'selected read-safe canary was absent from the fresh-spawn catalog'
+                };
+            }
+            else {
+                const called = await settle(() => request('tools/call', { name: toolId, arguments: input }));
+                if (called.ok) {
+                    const admitted = CallToolResultSchema.safeParse(called.value.result);
+                    if (!admitted.success) {
+                        canary = {
+                            toolId,
+                            status: 'failed',
+                            failureKind: 'schema',
+                            detail: 'MCP tool call result is not a CallToolResult'
+                        };
+                    }
+                    else if (admitted.data.isError === true) {
+                        canary = {
+                            toolId,
+                            status: 'failed',
+                            failureKind: 'implementation',
+                            detail: 'MCP tool call returned isError=true'
+                        };
+                    }
+                    else {
+                        canary = { toolId, status: 'passed' };
+                    }
+                }
+                else {
+                    const error = called.cause;
+                    const rpcCode = rpcRejectionCode(error);
+                    const failureKind = rpcCode === -32602 ? 'schema' : rpcCode === -32601 ? 'projection' : 'transport';
+                    canary = {
+                        toolId,
+                        status: 'failed',
+                        failureKind,
+                        detail: boundedDiagnostic(valueFreeFailure(error).name)
+                    };
+                }
+            }
+        }
+        const capture = {
+            clientId: options.clientId,
+            served,
+            captureMs: Date.now() - startedAt,
+            wireBytes: served.reduce((sum, tool) => sum + tool.wireBytes, 0),
+            birth,
+            canary
+        };
+        if (birthError)
+            capture.birthError = birthError;
+        return capture;
+    }
+    finally {
+        // Killing the child closes its pipes; its stdin needs no separate EOF.
+        await proc.kill();
+        // The killed child's output ends the reader; bound the drain, never wait on a wedged pipe.
+        const drained = await settle(() => lifecycle.wait(() => readerDone, { timeoutMs: 1_000, reason: 'wire-selfie-reader-drain' }));
+        if (!drained.ok && !isLifecycleDeadline(drained.cause)) {
+            getLogger('mcp', options.runtime).debug('tool audit: wire selfie reader drain failed', { failure: valueFreeFailure(drained.cause) });
+        }
+    }
+}
+/**
+ * Split one served entry's bytes by tool-entry key. `envelope` is the remainder, so
+ * the four parts always sum to `wireBytes` no matter what future keys the SDK adds —
+ * a breakdown that silently drops a key would be the same class of lie this exists to
+ * prevent. Each part is measured as the JSON the wire carried, including its own key
+ * name and separators, so the sum is exact rather than approximately right.
+ */
+export function splitWireParts(tool, wireBytes) {
+    // `"key":value,` — the cost of carrying this key at all, as serialized.
+    const keyBytes = (key) => key in tool ? new TextEncoder().encode(JSON.stringify(key)).byteLength + 1 + new TextEncoder().encode(JSON.stringify(tool[key])).byteLength + 1 : 0;
+    const inputSchema = keyBytes('inputSchema');
+    const outputSchema = keyBytes('outputSchema');
+    const description = keyBytes('description');
+    return {
+        inputSchema,
+        outputSchema,
+        description,
+        envelope: Math.max(wireBytes - inputSchema - outputSchema - description, 0)
+    };
+}
+/** Top-level property names the authoring path would put on the wire; a conversion failure is logged on `runtime`. */
+function authoredInputProperties(runtime, descriptor) {
+    const input = descriptor.schemas?.input;
+    if (!(input instanceof z.ZodType))
+        return input ? undefined : [];
+    const flattened = settleNow(() => flattenDiscriminatedUnionToObject(input));
+    if (!flattened.ok) {
+        // Authoring-side conversion failure is itself reported by the caller; the reason is logged too.
+        getLogger('mcp', runtime).debug('tool audit: input schema could not be flattened', { failure: valueFreeFailure(flattened.cause) });
+        return undefined;
+    }
+    const projected = settleNow(() => toRuntimeJsonSchema(flattened.value, { io: 'input', target: 'draft-7' }));
+    if (!projected.ok) {
+        getLogger('mcp', runtime).debug('tool audit: input schema could not be flattened', { failure: valueFreeFailure(projected.cause) });
+        return undefined;
+    }
+    const properties = asJsonObject(projected.value.properties);
+    return properties ? Object.keys(properties).sort() : [];
+}
+/**
+ * Pure diff of a capture against the local registry catalog. Local-catalog
+ * coverage caveats are reported as informational findings instead of silently
+ * skewing severities — the CLI world's plugin set can differ from serve's.
+ */
+export function diffWireSelfie(runtime, capture, configured) {
+    const customPresets = runtimePurposePresets(runtime, configured);
+    const descriptors = runtime.assets('tools/tool').descriptors().filter(isToolAsset);
+    const byId = new Map(descriptors.map((d) => [d.id, d]));
+    const servedByName = new Map(capture.served.map((s) => [s.name, s]));
+    const findings = [];
+    const localToolIds = localToolsOf(runtime).toolIds;
+    // Policy expectation WITHOUT availableIds: the serve world resolves its own
+    // loaders; a policy-selected tool missing from the wire is exactly the
+    // signal we exist to catch (loader gap there, or registration failure).
+    const expected = selectMcpTools(descriptors, { mcpClientId: capture.clientId, customPresets });
+    const expectedIds = new Set(expected.descriptors.map((d) => d.id));
+    for (const id of expectedIds) {
+        if (!servedByName.has(id)) {
+            findings.push({
+                severity: 'high',
+                code: 'selected-not-served',
+                toolId: id,
+                detail: 'policy-selected for this client but ABSENT from the served wire — serve-world ' +
+                    'loader gap or schema-registration failure (the brain-outage class); check serve logs'
+            });
+        }
+    }
+    for (const served of capture.served) {
+        const descriptor = byId.get(served.name);
+        if (!descriptor) {
+            findings.push({
+                severity: 'low',
+                code: 'served-not-in-local-catalog',
+                toolId: served.name,
+                detail: 'served on the wire but this audit world has no descriptor for it — ' +
+                    'description/schema diffs skipped (serve world composes more plugins)'
+            });
+            continue;
+        }
+        const authored = authoredInputProperties(runtime, descriptor);
+        if (authored === undefined) {
+            findings.push({
+                severity: 'medium',
+                code: 'authored-schema-unconvertible',
+                toolId: served.name,
+                detail: 'local authored input schema failed wire conversion — audit that schema'
+            });
+        }
+        else if (served.inputProperties.length === 0 && authored.length > 0) {
+            findings.push({
+                severity: 'high',
+                code: 'served-empty-schema',
+                toolId: served.name,
+                detail: `served inputSchema has NO properties while authoring produces [${authored.join(', ')}] — the field-laundering class`
+            });
+        }
+        else if (authored.length > 0) {
+            const missing = authored.filter((p) => !served.inputProperties.includes(p));
+            if (missing.length > 0) {
+                findings.push({
+                    severity: 'medium',
+                    code: 'served-property-loss',
+                    toolId: served.name,
+                    detail: `served schema is missing authored properties: ${missing.join(', ')}`
+                });
+            }
+        }
+        const expectedDescriptionRaw = resolveMcpDescription(descriptor);
+        // Local tools are advertised over MCP with a [local] prefix to distinguish them
+        // from platform tools. The live audit sees the prefixed description on the wire.
+        const isLocal = isLocalToolId(descriptor.id, localToolIds);
+        const expectedDescription = formatLocalMcpToolDescription(expectedDescriptionRaw, isLocal);
+        if (expectedDescription && served.description !== expectedDescription) {
+            findings.push({
+                severity: 'medium',
+                code: 'served-description-drift',
+                toolId: served.name,
+                detail: `served description differs from what current source produces — stale served body ` +
+                    `or wire mangling. served=${JSON.stringify(truncate(served.description ?? '', 80))} ` +
+                    `expected=${JSON.stringify(truncate(expectedDescription, 80))}`
+            });
+        }
+        if (!expectedIds.has(served.name)) {
+            findings.push({
+                severity: 'low',
+                code: 'served-not-selected',
+                toolId: served.name,
+                detail: 'on the wire but not in this client\'s policy selection (extra exposure)'
+            });
+        }
+    }
+    // Aggregate catalog weight, measured on the wire. Names the worst offenders,
+    // because "the catalog is too big" is unactionable and "browser is 12KB behind
+    // an 80-char description" is a decision someone can make.
+    if (capture.wireBytes > WIRE_CATALOG_BUDGET_BYTES) {
+        // Name each offender's own composition, not just its total: "awareness 18253B
+        // (59% out)" points at the output schema; "workspace-fs 10840B (86% in)" points
+        // at the action union. The old text prescribed "split a wide action union" for
+        // both, which is wrong for the first and cost a session to discover.
+        const heaviest = [...capture.served]
+            .sort((a, b) => b.wireBytes - a.wireBytes)
+            .slice(0, 5)
+            .map((t) => `${t.name} ${t.wireBytes}B (${describeComposition(t)})`)
+            .join(', ');
+        const totals = capture.served.reduce((sum, t) => ({
+            inputSchema: sum.inputSchema + t.parts.inputSchema,
+            outputSchema: sum.outputSchema + t.parts.outputSchema,
+            description: sum.description + t.parts.description,
+            envelope: sum.envelope + t.parts.envelope
+        }), { inputSchema: 0, outputSchema: 0, description: 0, envelope: 0 });
+        const pct = (n) => `${Math.round((n / capture.wireBytes) * 100)}%`;
+        findings.push({
+            severity: 'medium',
+            code: 'wire-catalog-budget-exceeded',
+            toolId: `client:${capture.clientId}`,
+            detail: `tools/list serves ${capture.served.length} tools totalling ${capture.wireBytes} bytes ` +
+                `(~${Math.round(capture.wireBytes / 3.6)} tokens), over the ${WIRE_CATALOG_BUDGET_BYTES}-byte ` +
+                `catalog budget. Every non-deferring client pays this on every request. ` +
+                `Composition: inputSchema ${totals.inputSchema}B (${pct(totals.inputSchema)}), ` +
+                `outputSchema ${totals.outputSchema}B (${pct(totals.outputSchema)}), ` +
+                `description ${totals.description}B (${pct(totals.description)}), ` +
+                `envelope ${totals.envelope}B (${pct(totals.envelope)}). ` +
+                `Heaviest: ${heaviest}. Fix what the split names — an input-heavy tool wants its ` +
+                `action union split or deferred; an output-heavy one cannot be fixed that way at all. ` +
+                `Raising the budget is a real decision, not the default fix`
+        });
+    }
+    findings.sort((a, b) => severityRank(a.severity) - severityRank(b.severity) || a.toolId.localeCompare(b.toolId));
+    return {
+        view: 'wire',
+        clientId: capture.clientId,
+        servedCount: capture.served.length,
+        expectedCount: expectedIds.size,
+        captureMs: capture.captureMs,
+        wireBytes: capture.wireBytes,
+        findings,
+        ok: findings.every((f) => f.severity !== 'high')
+    };
+}
+export async function runWireSelfie(runtime, options) {
+    const capture = await captureWireSelfie({
+        ...options,
+        runtime,
+        cwd: await runtime.context('runtime/workspace-path')
+    });
+    return diffWireSelfie(runtime, capture, await loadPurposePresetOverrides(runtime));
+}
+/**
+ * The dominant key of one entry, as a two-word hint the reader can act on. Reports
+ * the majority share only — a 45/40 split gets `mixed`, because calling that one
+ * "input-heavy" would aim the remedy at just over half the bytes.
+ */
+function describeComposition(tool) {
+    const { inputSchema, outputSchema } = tool.parts;
+    const share = (n) => Math.round((n / Math.max(tool.wireBytes, 1)) * 100);
+    if (inputSchema >= outputSchema * 2)
+        return `${share(inputSchema)}% in`;
+    if (outputSchema >= inputSchema * 2)
+        return `${share(outputSchema)}% out`;
+    return `${share(inputSchema)}% in / ${share(outputSchema)}% out`;
+}
+function truncate(value, max) {
+    return value.length > max ? `${value.slice(0, max)}…` : value;
+}
+function severityRank(severity) {
+    return severity === 'high' ? 0 : severity === 'medium' ? 1 : 2;
+}
+function boundedDiagnostic(value) {
+    return value.length > 240 ? `${value.slice(0, 240)}…` : value;
+}
+//# sourceMappingURL=tool-audit-live.js.map

package/dist/adapters/mcp/tool-audit-live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-audit-live.js","sourceRoot":"","sources":["../../../src/adapters/mcp/tool-audit-live.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AAEpF;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAA0D,MAAM,qBAAqB,CAAC;AACtL,OAAO,EAAE,gBAAgB,EAAmB,MAAM,kCAAkC,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAE9E,OAAO,EAAE,iCAAiC,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kDAAkD,CAAC;AAC/F,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAElE,OAAO,EACN,8BAA8B,EAE9B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,qBAAqB,EAAqI,MAAM,wBAAwB,CAAC;AAG5O;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAEjD,SAAS,YAAY,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,CAAC;AAC3F,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC9B,OAAO,IAAI,eAAe,CAAC,oCAAoC,EAAE,UAAU,EAAE;QAC5E,MAAM,EAAE,mBAAmB;QAC3B,OAAO,EAAE,EAAE,IAAI,EAAE;KACjB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAoB;IAC7C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,2EAA2E;AAC3E,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAmBvC;IACA,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;IACzB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;IAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACrE,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,IAAI;QACT,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;QACpC,OAAO,EAAE,SAAS;QAClB,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,QAAQ;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAElC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyC,CAAC;IACjE,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,SAAS,CAAC;YACT,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,OAAO,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBACnC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACpC,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;oBACpB,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,yDAAyD,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpJ,SAAS;gBACV,CAAC;gBACD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC;gBAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,kCAAkC;oBAAE,cAAc,GAAG,IAAI,CAAC;gBAC7E,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;oBAC3B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACxB,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IAEL,SAAS,IAAI,CAAC,OAAmB;QAChC,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,SAAS,OAAO,CAAC,MAAc,EAAE,MAAkB;QAClD,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChE,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;gBACrC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,MAAM,gBAAgB,SAAS,kBAAkB,CAAC,CAAC,CAAC;YACvF,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,MAAM,EAAE,CAAC;gBACT,IAAI,GAAG,CAAC,KAAK;oBAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;;oBAC5C,OAAO,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,KAAK,IAAI,EAAE;gBACtB,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;gBAChB,IAAI,IAAI,CAAC,EAAE;oBAAE,OAAO;gBACpB,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;YACpD,MAAM,IAAI,KAAK,CACd,2CAA2C,IAAI,YAAY,MAAM,aAAa,CAC9E,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE;YAC9C,eAAe,EAAE,YAAY;YAC7B,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE,IAAI,EAAE,eAAe,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;SACzE,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACpE,IAAI,KAA0C,CAAC;QAC/C,IAAI,UAA8B,CAAC;QACnC,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,8BAA8B,CACrE,aAAa,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,EACzF,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAChE,CAAC,CAAC;QACH,IAAI,YAAY,CAAC,EAAE;YAAE,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC;;YAC3C,UAAU,GAAG,uFAAuF,CAAC;QAE1G,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,uEAAuE;QACvE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YAClB,cAAc,GAAG,KAAK,CAAC;YACvB,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC5D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjC,iEAAiE;oBACjE,iEAAiE;oBACjE,8BAA8B;oBAC9B,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;oBAC5E,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;oBACnD,MAAM,UAAU,GAAG,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;oBACzD,MAAM,CAAC,IAAI,CAAC;wBACX,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,WAAW,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;wBAC3E,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;wBACjE,SAAS;wBACT,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC;qBACtC,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,CAAC,QAAQ,MAAM,EAAE;YACjB,IAAI,CAAC,cAAc;gBAAE,MAAM;YAC3B,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,MAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;gBAClD,MAAM,GAAG;oBACR,MAAM;oBACN,MAAM,EAAE,YAAY;oBACpB,WAAW,EAAE,YAAY;oBACzB,MAAM,EAAE,mEAAmE;iBAC3E,CAAC;YACH,CAAC;iBAAM,CAAC;gBACP,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC7F,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACrE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;wBACvB,MAAM,GAAG;4BACR,MAAM;4BACN,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,QAAQ;4BACrB,MAAM,EAAE,8CAA8C;yBACtD,CAAC;oBACH,CAAC;yBAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;wBAC3C,MAAM,GAAG;4BACR,MAAM;4BACN,MAAM,EAAE,QAAQ;4BAChB,WAAW,EAAE,gBAAgB;4BAC7B,MAAM,EAAE,qCAAqC;yBAC7C,CAAC;oBACH,CAAC;yBAAM,CAAC;wBACP,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;oBACvC,CAAC;gBACF,CAAC;qBAAM,CAAC;oBACP,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;oBAC3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;oBACxC,MAAM,WAAW,GAAG,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;oBACpG,MAAM,GAAG;wBACR,MAAM;wBACN,MAAM,EAAE,QAAQ;wBAChB,WAAW;wBACX,MAAM,EAAE,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;qBACvD,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,OAAO,GAAsB;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAChE,KAAK;YACL,MAAM;SACN,CAAC;QACF,IAAI,UAAU;YAAE,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;QAChD,OAAO,OAAO,CAAC;IAChB,CAAC;YAAS,CAAC;QACV,uEAAuE;QACvE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,2FAA2F;QAC3F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;QAC/H,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,6CAA6C,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtI,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAgB,EAAE,SAAiB;IACjE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE,CACxC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrJ,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC5C,OAAO;QACN,WAAW;QACX,YAAY;QACZ,WAAW;QACX,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,EAAE,CAAC,CAAC;KAC3E,CAAC;AACH,CAAC;AAED,sHAAsH;AACtH,SAAS,uBAAuB,CAAC,OAAmB,EAAE,UAA+B;IACpF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC;IACxC,IAAI,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,iCAAiC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,gGAAgG;QAChG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,iDAAiD,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnI,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACnB,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,iDAAiD,EAAE,EAAE,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnI,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5D,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC7B,OAAqB,EACrB,OAA0B,EAC1B,UAA0C;IAE1C,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;IAEnD,4EAA4E;IAC5E,uEAAuE;IACvE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IAC/F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEnE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,EAAE;gBACV,MAAM,EACL,gFAAgF;oBAChF,sFAAsF;aACvF,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,MAAM,EACL,qEAAqE;oBACrE,sEAAsE;aACvE,CAAC,CAAC;YACH,SAAS;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,+BAA+B;gBACrC,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,MAAM,EAAE,wEAAwE;aAChF,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,MAAM,EAAE,kEAAkE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;aAC7H,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CAAC;oBACb,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,sBAAsB;oBAC5B,MAAM,EAAE,MAAM,CAAC,IAAI;oBACnB,MAAM,EAAE,iDAAiD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBAC7E,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,MAAM,sBAAsB,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACjE,gFAAgF;QAChF,iFAAiF;QACjF,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,sBAAsB,EAAE,OAAO,CAAC,CAAC;QAC3F,IAAI,mBAAmB,IAAI,MAAM,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,MAAM,EACL,mFAAmF;oBACnF,4BAA4B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG;oBACrF,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,EAAE;aAChE,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,MAAM,EAAE,yEAAyE;aACjF,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,0DAA0D;IAC1D,IAAI,OAAO,CAAC,SAAS,GAAG,yBAAyB,EAAE,CAAC;QACnD,8EAA8E;QAC9E,gFAAgF;QAChF,+EAA+E;QAC/E,qEAAqE;QACrE,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;aACzC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,MAAM,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC;aACnE,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CACnC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACZ,WAAW,EAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW;YAClD,YAAY,EAAE,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY;YACrD,WAAW,EAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW;YAClD,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ;SACzC,CAAC,EACF,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAChE,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC;QACnF,QAAQ,CAAC,IAAI,CAAC;YACb,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;YACpC,MAAM,EACL,qBAAqB,OAAO,CAAC,MAAM,CAAC,MAAM,oBAAoB,OAAO,CAAC,SAAS,SAAS;gBACxF,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC,sBAAsB,yBAAyB,QAAQ;gBAC/F,yEAAyE;gBACzE,4BAA4B,MAAM,CAAC,WAAW,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK;gBAChF,gBAAgB,MAAM,CAAC,YAAY,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK;gBACtE,eAAe,MAAM,CAAC,WAAW,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK;gBACnE,YAAY,MAAM,CAAC,QAAQ,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK;gBAC1D,aAAa,QAAQ,6DAA6D;gBAClF,uFAAuF;gBACvF,4DAA4D;SAC7D,CAAC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAI,CACZ,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CACjG,CAAC;IAEF,OAAO;QACN,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;QAClC,aAAa,EAAE,WAAW,CAAC,IAAI;QAC/B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ;QACR,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC;KAChD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,OAAqB,EACrB,OAAoE;IAEpE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC;QACvC,GAAG,OAAO;QACV,OAAO;QACP,GAAG,EAAE,MAAM,OAAO,CAAC,OAAO,CAAS,wBAAwB,CAAC;KAC5D,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAgB;IAC5C,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACzF,IAAI,WAAW,IAAI,YAAY,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;IACxE,IAAI,YAAY,IAAI,WAAW,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;IAC1E,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,UAAU,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC3C,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC;AAED,SAAS,YAAY,CAAC,QAAsC;IAC3D,OAAO,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC"}

package/dist/adapters/mcp/tool-audit.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Tool-exposure audit — the czar cycle's reusable core.
+ *
+ * ONE implementation of "is every declared tool reachable and wire-honest",
+ * consumed by both the `vibes dev audit tools` CLI command and (future) a
+ * `tools/tool` runtime capability. It does NOT re-implement the exposure funnel:
+ * it drives the real `explainMcpToolSelection` (the same mirror the serve path
+ * logs) across every MCP client preset, over the real runtime descriptor
+ * catalog.
+ *
+ * SCOPE — this is the POLICY view (world-independent): it audits what each preset
+ * *intends* to expose from the declared catalog, plus wire-shape properties of the
+ * descriptors. It deliberately does NOT assert loader-resolvability, because that
+ * depends on which plugins the *running* world composed — the ambient CLI world
+ * is not the MCP serve world, so a bare `available()` here under-reports and would
+ * cry "zombie" for tools the serve path loads fine. Serve-world reachability +
+ * served-vs-authored schema drift is the job of the live "Wire Selfie" handshake
+ * (the earned next in docs/proposals/universal-tools-czar/), which spawns a real
+ * serve per preset and diffs tools/list. Keeping v1 honest beats a plausible-wrong
+ * verdict. Distinct from the static `scripts/check-tool-coverage.ts` gate (source
+ * text scan for descriptor↔loader drift): this drives the LIVE registry policy.
+ */
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { PurposePreset } from '@vibesdotdev/tools/schemas/presets/schema';
+import type { ToolAuditReport } from '../../schemas/audit.ts';
+export type { PresetExposure, ToolAuditFinding, ToolAuditReport } from '../../schemas/audit.ts';
+/**
+ * Run the exposure POLICY audit against the live runtime catalog. Pure of
+ * process/stdout so the CLI, a scheduled guard, a test, and a future tools/tool
+ * can all consume it.
+ */
+export declare function runToolExposureAudit(runtime: VibesRuntime, configured?: Record<string, PurposePreset>): ToolAuditReport;
+/**
+ * The orphan rule, extracted so it stays falsifiable: the registry offers no
+ * injection point for a synthetic preset set, and under a `*` base catalog no
+ * real descriptor can currently trip it end-to-end.
+ *
+ * A tool is an ACCIDENTAL orphan when no audited preset exposes it AND no
+ * preset excluded it on purpose (`disabled-pattern` / `preset-explicit-disable`).
+ * Exposure through a catch-all preset counts — a tool served to claude is not
+ * orphaned.
+ */
+export declare function isAccidentalOrphan(exposedByAnyPreset: boolean, exclusionReasons: ReadonlySet<string>): boolean;
+//# sourceMappingURL=tool-audit.d.ts.map

package/dist/adapters/mcp/tool-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-audit.d.ts","sourceRoot":"","sources":["../../../src/adapters/mcp/tool-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAY/E,OAAO,KAAK,EAAoC,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAChG,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEhG;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,eAAe,CA2HvH;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CACjC,kBAAkB,EAAE,OAAO,EAC3B,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GACnC,OAAO,CAKT"}