@vornrun/mcp 0.7.0-beta.1 → 0.7.0-beta.11

package/dist/index.js

@@ -50,8 +50,32 @@ import fs from "fs";
 import path from "path";
 
 // ../shared/src/protocol.ts
+var BOOTSTRAP_ENV_VAR = "SECRET_VORN_BOOTSTRAP_TOKEN";
 var LOCAL_TOKEN_FILENAME = "local-token";
 
+// ../shared/src/types.ts
+var DEFAULT_WORKSPACE = {
+  id: "personal",
+  name: "Personal",
+  icon: "User",
+  iconColor: "#6b7280",
+  order: 0
+};
+function isTerminalTaskStatus(status) {
+  return status === "done" || status === "cancelled";
+}
+var SDK_FILTER_KEYS = {
+  connectorId: "sdkConnectorId",
+  version: "sdkVersion",
+  icon: "sdkIcon",
+  implicit: "implicit"
+};
+var NEVER_BORROWED_ENV = { keys: ["CLAUDECODE"], prefixes: ["CLAUDE_CODE_"] };
+function connectionConnectorId(connection2) {
+  const packaged = connection2.filters?.[SDK_FILTER_KEYS.connectorId];
+  return typeof packaged === "string" && packaged !== "" ? packaged : connection2.connectorId;
+}
+
 // ../server/src/process-utils.ts
 function getDefaultShell(configured) {
   const chosen = configured?.trim();
@@ -76,30 +100,10 @@ function findWindowsShell() {
   if (fs.existsSync(windowsPowerShell)) return windowsPowerShell;
   return process.env.COMSPEC || "cmd.exe";
 }
-var STRIP_ENV_KEYS = ["CLAUDECODE"];
+var STRIP_ENV_KEYS = NEVER_BORROWED_ENV.keys;
+var STRIP_ENV_PREFIXES = [...NEVER_BORROWED_ENV.prefixes, BOOTSTRAP_ENV_VAR];
 var STRIP_ENV_KEYS_UPPER = STRIP_ENV_KEYS.map((k) => k.toUpperCase());
 
-// ../shared/src/types.ts
-var DEFAULT_WORKSPACE = {
-  id: "personal",
-  name: "Personal",
-  icon: "User",
-  iconColor: "#6b7280",
-  order: 0
-};
-function isTerminalTaskStatus(status) {
-  return status === "done" || status === "cancelled";
-}
-var SDK_FILTER_KEYS = {
-  connectorId: "sdkConnectorId",
-  version: "sdkVersion",
-  icon: "sdkIcon"
-};
-function connectionConnectorId(connection2) {
-  const packaged = connection2.filters?.[SDK_FILTER_KEYS.connectorId];
-  return typeof packaged === "string" && packaged !== "" ? packaged : connection2.connectorId;
-}
-
 // ../server/src/default-workflows.ts
 var DEFAULT_TASK_WORKFLOW_ID = "system:default-task-workflow";
 function buildDefaultTaskWorkflow() {
@@ -888,6 +892,51 @@ function migrateSchema(d) {
     })();
     logger_default.info("[database] migrated schema to version 15 (config row revisions)");
   }
+  if (version < 16) {
+    d.transaction(() => {
+      const cols = d.prepare("PRAGMA table_info(sessions)").all();
+      if (!cols.some((c) => c.name === "shell_cwd")) {
+        d.exec("ALTER TABLE sessions ADD COLUMN shell_cwd TEXT");
+      }
+      d.prepare(
+        "INSERT OR REPLACE INTO schema_meta (key, value) VALUES ('schema_version', '16')"
+      ).run();
+    })();
+    logger_default.info("[database] migrated schema to version 16 (shell working directory)");
+  }
+  if (version < 17) {
+    d.transaction(() => {
+      const derived = `(
+        SELECT json_extract(sc.filters, '$.sdkConnectorId')
+          FROM task_source_links tsl
+          JOIN source_connections sc ON sc.id = tsl.connection_id
+         WHERE tsl.task_id = tasks.id
+      )`;
+      d.exec(`
+        UPDATE tasks
+           SET source_connector_id = ${derived}
+         WHERE source_connector_id = 'mcp' AND ${derived} IS NOT NULL
+      `);
+      d.exec(`
+        UPDATE task_source_links
+           SET connector_id = (
+             SELECT json_extract(sc.filters, '$.sdkConnectorId')
+               FROM source_connections sc
+              WHERE sc.id = task_source_links.connection_id
+           )
+         WHERE connector_id = 'mcp'
+           AND (
+             SELECT json_extract(sc.filters, '$.sdkConnectorId')
+               FROM source_connections sc
+              WHERE sc.id = task_source_links.connection_id
+           ) IS NOT NULL
+      `);
+      d.prepare(
+        "INSERT OR REPLACE INTO schema_meta (key, value) VALUES ('schema_version', '17')"
+      ).run();
+    })();
+    logger_default.info("[database] migrated schema to version 17 (packaged connector task ids)");
+  }
 }
 var REVISIONED_TABLES = [
   "projects",
@@ -930,7 +979,8 @@ function verifySchema(d) {
         ddl: "ALTER TABLE sessions ADD COLUMN sort_order INTEGER NOT NULL DEFAULT 0"
       },
       { column: "worktree_name", ddl: "ALTER TABLE sessions ADD COLUMN worktree_name TEXT" },
-      { column: "agent_session_id", ddl: "ALTER TABLE sessions ADD COLUMN agent_session_id TEXT" }
+      { column: "agent_session_id", ddl: "ALTER TABLE sessions ADD COLUMN agent_session_id TEXT" },
+      { column: "shell_cwd", ddl: "ALTER TABLE sessions ADD COLUMN shell_cwd TEXT" }
     ],
     agent_commands: [
       {
@@ -1078,7 +1128,13 @@ function loadDefaults(d) {
     ...map.hasSeenOnboarding !== void 0 && {
       hasSeenOnboarding: map.hasSeenOnboarding
     },
-    ...map.reopenSessions !== void 0 && { reopenSessions: map.reopenSessions },
+    // Default on, and that changed meaning rather than merely flipping. It used
+    // to decide whether every saved session was relaunched at start-up, which
+    // spends tokens and starts processes -- worth asking about, so it was off.
+    // Bringing a pane back no longer does either: it shows the last screen its
+    // terminal drew and waits. There is nothing to ask, and leaving it off made
+    // the whole thing invisible unless somebody went looking for a toggle.
+    reopenSessions: map.reopenSessions ?? true,
     // Saving iterates over every key in defaults, but loading is this explicit
     // list — so a key missing here round-trips to nothing and its feature is
     // silently inert.
@@ -1092,6 +1148,10 @@ function loadDefaults(d) {
     // user has toggled it, so absence means "not yet decided", not "off".
     domBlockRendering: map.domBlockRendering ?? true,
     minimalShellPrompt: map.minimalShellPrompt ?? true,
+    // Sessions outlive the window. Default on, same reasoning as above: the key
+    // only appears once the user has turned it off, so absence is "not yet
+    // decided". Read by the main process at quit, not by the renderer.
+    keepSessionsRunning: map.keepSessionsRunning ?? true,
     ...map.widgetEnabled !== void 0 && { widgetEnabled: map.widgetEnabled },
     ...map.taskViewMode !== void 0 && {
       taskViewMode: map.taskViewMode
@@ -1592,7 +1652,7 @@ var configManager = new ConfigManager();
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/tools/tasks.ts
-import crypto from "crypto";
+import crypto2 from "crypto";
 import path4 from "path";
 import { z as z2 } from "zod";
 
@@ -1989,7 +2049,7 @@ function registerTaskTools(server) {
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const status = args.status ?? "todo";
       const task = {
-        id: crypto.randomUUID(),
+        id: crypto2.randomUUID(),
         projectName: args.project_name,
         title: args.title,
         description: args.description ?? "",
@@ -2689,41 +2749,63 @@ function registerSessionTools(server) {
 }
 
 // src/tools/workflows.ts
-import crypto2 from "crypto";
+import crypto3 from "crypto";
 import { z as z5 } from "zod";
 
-// src/workflow-portability.ts
+// ../shared/src/workflow-portability.ts
 var PROJECT_PATH_TOKEN = "{{project.path}}";
 var PROJECT_NAME_TOKEN = "{{project.name}}";
 var PORTABLE_FORMAT_VERSION = 1;
+var HTTP_PROFILE_CONNECTOR = "http";
 function importedWorkflowId(bundle, slug) {
   return `import:${bundle}:${slug}`;
 }
+function importedWorkflowIdFor(bundle, slug, name, existing) {
+  for (let attempt = 1; ; attempt++) {
+    const id = importedWorkflowId(bundle, attempt === 1 ? slug : `${slug}-${attempt}`);
+    const held = existing.find((workflow) => workflow.id === id);
+    if (!held || held.name === name) return id;
+  }
+}
 function slugify(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "workflow";
 }
-function portabilityBlockers(workflow) {
-  const blockers = [];
-  for (const node of workflow.nodes) {
-    const config = node.config;
-    if (node.type === "trigger" && config.triggerType === "connectorPoll") {
-      blockers.push(`the trigger polls a connector connection, which exists only on this machine`);
-    }
-    if (node.type === "callConnectorAction") {
-      blockers.push(`step "${node.label}" calls a connector action bound to a local connection`);
-    }
+function connectorOf(connection2) {
+  return connectionConnectorId({
+    connectorId: connection2.connectorId,
+    filters: connection2.filters ?? {}
+  });
+}
+function boundConnectionKey(node, config) {
+  if (node.type === "trigger" && config.triggerType === "connectorPoll") return "connectionId";
+  if (node.type === "callConnectorAction") return "connectionId";
+  if (node.type === "httpRequest") return "profileConnectionId";
+  if (node.type === "script") return "secretsFrom";
+  return null;
+}
+var OPTIONAL_CONNECTION_KEYS = /* @__PURE__ */ new Set(["profileConnectionId", "secretsFrom"]);
+function resolveRequirement(requirement, connections) {
+  const candidates = connections.filter(
+    (connection2) => requirement.kind === "httpProfile" ? connectorOf(connection2) === HTTP_PROFILE_CONNECTOR : requirement.connectorId !== "" && connectorOf(connection2) === requirement.connectorId
+  );
+  if (candidates.length === 0) return void 0;
+  if (requirement.name !== "") {
+    const named = candidates.filter((connection2) => connection2.name === requirement.name);
+    if (named.length === 1) return named[0].id;
   }
-  return blockers;
+  return candidates.length === 1 ? candidates[0].id : void 0;
 }
-function toPortable(workflow, projectPath) {
+function toPortable(workflow, projectPath, connections = []) {
   const slug = slugify(workflow.name);
+  const requires = [];
   const nodes = workflow.nodes.map((node) => {
     const config = { ...node.config };
+    if (node.type === "trigger" && config.triggerType === "webhook") config.token = "";
     if (node.type === "launchAgent" || node.type === "script") {
-      for (const key of ["projectPath", "cwd", "existingWorktreePath"]) {
-        const value = config[key];
+      for (const key2 of ["projectPath", "cwd", "existingWorktreePath"]) {
+        const value = config[key2];
         if (typeof value === "string" && value) {
-          config[key] = replacePath(value, projectPath);
+          config[key2] = replacePath(value, projectPath);
         }
       }
       if (typeof config.projectName === "string" && config.projectName) {
@@ -2731,6 +2813,26 @@ function toPortable(workflow, projectPath) {
       }
       delete config.remoteHostId;
     }
+    const key = boundConnectionKey(node, config);
+    const bound = key === null ? "" : config[key];
+    const unbound = key !== null && !OPTIONAL_CONNECTION_KEYS.has(key) && bound === "";
+    if (key !== null && (typeof bound === "string" && bound !== "" || unbound)) {
+      const source2 = connections.find((connection2) => connection2.id === bound);
+      const event = config.event;
+      const declared = config.connectorId;
+      requires.push(
+        key === "profileConnectionId" ? { kind: "httpProfile", nodeId: node.id, name: source2?.name ?? "" } : {
+          kind: "connection",
+          nodeId: node.id,
+          connectorId: source2 ? connectorOf(source2) : typeof declared === "string" ? declared : "",
+          name: source2?.name ?? "",
+          ...typeof event === "string" && event !== "" && { event },
+          ...key === "secretsFrom" && { key }
+        }
+      );
+      if (OPTIONAL_CONNECTION_KEYS.has(key)) delete config[key];
+      else config[key] = "";
+    }
     return { ...node, config };
   });
   return {
@@ -2740,6 +2842,7 @@ function toPortable(workflow, projectPath) {
     ...workflow.icon && { icon: workflow.icon },
     ...workflow.iconColor && { iconColor: workflow.iconColor },
     ...workflow.staggerDelayMs !== void 0 && { staggerDelayMs: workflow.staggerDelayMs },
+    ...requires.length > 0 && { requires },
     nodes,
     edges: workflow.edges
   };
@@ -2750,16 +2853,40 @@ function normalizeForCompare(p) {
 function replacePath(value, projectPath) {
   const v = normalizeForCompare(value);
   const root = normalizeForCompare(projectPath);
+  if (root === "") return value;
   if (v === root) return PROJECT_PATH_TOKEN;
   if (v.startsWith(`${root}/`)) return `${PROJECT_PATH_TOKEN}/${v.slice(root.length + 1)}`;
   return value;
 }
-function fromPortable(portable, bundle, project) {
+function unresolvedRequirements(portable, connections) {
+  const present = new Set(portable.nodes.map((node) => node.id));
+  return (portable.requires ?? []).filter(
+    (requirement) => present.has(requirement.nodeId) && (bindsOnlyByHand(requirement) || resolveRequirement(requirement, connections) === void 0)
+  );
+}
+function bindsOnlyByHand(requirement) {
+  return requirement.kind === "connection" && requirement.key === "secretsFrom";
+}
+function fromPortable(portable, bundle, project, connections = [], mintToken = () => crypto.randomUUID()) {
+  const bindings = /* @__PURE__ */ new Map();
+  for (const requirement of portable.requires ?? []) {
+    bindings.set(requirement.nodeId, [...bindings.get(requirement.nodeId) ?? [], requirement]);
+  }
   const nodes = portable.nodes.map((node) => {
     const config = { ...node.config };
-    for (const [key, value] of Object.entries(config)) {
+    const key = boundConnectionKey(node, config);
+    if (key !== null && OPTIONAL_CONNECTION_KEYS.has(key)) delete config[key];
+    for (const [key2, value] of Object.entries(config)) {
       if (typeof value !== "string") continue;
-      config[key] = value.split(PROJECT_PATH_TOKEN).join(project.path.replace(/[/\\]+$/, "")).split(PROJECT_NAME_TOKEN).join(project.name);
+      config[key2] = value.split(PROJECT_PATH_TOKEN).join(project.path.replace(/[/\\]+$/, "")).split(PROJECT_NAME_TOKEN).join(project.name);
+    }
+    for (const requirement of bindings.get(node.id) ?? []) {
+      if (bindsOnlyByHand(requirement) || key === null) continue;
+      const resolved = resolveRequirement(requirement, connections);
+      if (resolved !== void 0) config[key] = resolved;
+    }
+    if (node.type === "trigger" && config.triggerType === "webhook" && !config.token) {
+      config.token = mintToken();
     }
     return { ...node, config };
   });
@@ -2768,7 +2895,9 @@ function fromPortable(portable, bundle, project) {
     name: portable.name,
     icon: portable.icon ?? "Zap",
     iconColor: portable.iconColor ?? "#6366f1",
-    enabled: true,
+    // A file cannot ask to be running: a dropped cron workflow would start
+    // firing before anyone had read it. Callers restore what they had.
+    enabled: false,
     ...portable.staggerDelayMs !== void 0 && { staggerDelayMs: portable.staggerDelayMs },
     nodes,
     edges: portable.edges
@@ -2891,6 +3020,18 @@ var triggerConfigSchema = z5.union([
     projectFilter: V.name.optional(),
     fromStatus: z5.enum(["todo", "in_progress", "in_review", "done", "cancelled"]).optional(),
     toStatus: z5.enum(["todo", "in_progress", "in_review", "done", "cancelled"]).optional()
+  }),
+  z5.object({
+    triggerType: z5.literal("connectorPoll"),
+    connectionId: V.id,
+    event: V.shortText,
+    cron: V.shortText,
+    timezone: V.shortText.optional()
+  }),
+  z5.object({
+    triggerType: z5.literal("webhook"),
+    method: z5.enum(["POST", "GET"]),
+    token: V.shortText
   })
 ]);
 var nodeSchema = z5.object({
@@ -2905,6 +3046,7 @@ var nodeSchema = z5.object({
     "approval",
     "createTaskFromItem",
     "callConnectorAction",
+    "httpRequest",
     "loop"
   ]),
   label: V.shortText,
@@ -2966,7 +3108,7 @@ function buildGraphFromFlat(trigger, actions) {
   const nodes = [];
   const edges = [];
   const triggerNode = {
-    id: crypto2.randomUUID(),
+    id: crypto3.randomUUID(),
     type: "trigger",
     label: trigger.triggerType === "manual" ? "Manual Trigger" : trigger.triggerType === "once" ? "Schedule (Once)" : trigger.triggerType === "recurring" ? "Schedule (Recurring)" : trigger.triggerType === "taskCreated" ? "When Task Created" : trigger.triggerType === "taskStatusChanged" ? "When Task Status Changes" : "Trigger",
     config: trigger,
@@ -2977,7 +3119,7 @@ function buildGraphFromFlat(trigger, actions) {
   const NODE_GAP = 140;
   for (let i = 0; i < actions.length; i++) {
     const action = actions[i];
-    const nodeId = crypto2.randomUUID();
+    const nodeId = crypto3.randomUUID();
     nodes.push({
       id: nodeId,
       type: "launchAgent",
@@ -2986,7 +3128,7 @@ function buildGraphFromFlat(trigger, actions) {
       position: { x: 0, y: (i + 1) * NODE_GAP }
     });
     edges.push({
-      id: crypto2.randomUUID(),
+      id: crypto3.randomUUID(),
       source: prevId,
       target: nodeId
     });
@@ -3063,6 +3205,13 @@ function resolveWorkflowId(args) {
   }
   return { id };
 }
+async function listPortableConnections() {
+  try {
+    return await rpcCall("connection:list", { connectorId: void 0 });
+  } catch {
+    return [];
+  }
+}
 function registerWorkflowTools(server) {
   server.tool(
     "list_workflows",
@@ -3115,7 +3264,7 @@ function registerWorkflowTools(server) {
         edges = graph.edges;
       }
       const workflow = {
-        id: crypto2.randomUUID(),
+        id: crypto3.randomUUID(),
         name: args.name,
         icon: args.icon ?? "Zap",
         iconColor: args.icon_color ?? "#6366f1",
@@ -3385,7 +3534,7 @@ Run history: list_workflow_runs with workflow_id ${args.workflow_id}`
   );
   server.tool(
     "export_workflow",
-    "Export a workflow as a portable file you can commit beside the code it drives. Absolute paths become {{project.path}} and the local remote-host binding is dropped, so it runs on another machine after import. Refuses a workflow bound to a connector connection, whose id means nothing elsewhere.",
+    "Export a workflow as a portable file you can commit beside the code it drives. Absolute paths become {{project.path}} and the local remote-host binding is dropped, so it runs on another machine after import. Connections are dropped too and recorded as requirements the importing machine rebinds by connector and name.",
     {
       workflow_id: V.id.optional().describe("Workflow ID (from list_workflows)"),
       id: V.id.optional().describe("Deprecated alias for workflow_id")
@@ -3402,18 +3551,6 @@ Run history: list_workflow_runs with workflow_id ${args.workflow_id}`
           isError: true
         };
       }
-      const blockers = portabilityBlockers(workflow);
-      if (blockers.length > 0) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `Error: "${workflow.name}" cannot be exported portably because ` + blockers.join("; ") + ". Rebuild those steps without the connection, or keep this workflow local."
-            }
-          ],
-          isError: true
-        };
-      }
       const projects = await dbListProjects();
       const projectName = workflow.nodes.map((n) => n.config.projectName).find((name) => typeof name === "string" && name.length > 0);
       const project = projects.find((p) => p.name === projectName);
@@ -3428,15 +3565,20 @@ Run history: list_workflow_runs with workflow_id ${args.workflow_id}`
           isError: true
         };
       }
-      const portable = toPortable(workflow, project.path);
+      const portable = toPortable(workflow, project.path, await listPortableConnections());
       const residual = residualAbsolutePaths(portable);
+      const unnamed = (portable.requires ?? []).filter(
+        (requirement) => requirement.kind === "connection" && requirement.connectorId === ""
+      );
       return {
         content: [
           {
             type: "text",
             text: JSON.stringify(portable, null, 2) + (residual.length > 0 ? `
 
-Warning: these still hold a machine-specific path and will not travel: ${residual.join(", ")}` : "")
+Warning: these still hold a machine-specific path and will not travel: ${residual.join(", ")}` : "") + (unnamed.length > 0 ? `
+
+Warning: ${unnamed.length} step(s) point at a connection this install could not name, so an import cannot rebind them automatically.` : "")
           }
         ]
       };
@@ -3444,7 +3586,7 @@ Warning: these still hold a machine-specific path and will not travel: ${residua
   );
   server.tool(
     "import_workflow",
-    "Import a workflow exported by export_workflow, resolving {{project.path}} and {{project.name}} against a registered project. The id is derived from the bundle and the workflow's slug, so importing the same file again updates it in place instead of creating a duplicate.",
+    "Import a workflow exported by export_workflow, resolving {{project.path}} and {{project.name}} against a registered project. Recorded connection requirements are rebound when this machine has one unambiguous match, and reported as still to connect otherwise. The id is derived from the bundle and the workflow's slug, so importing the same file again updates it in place instead of creating a duplicate.",
     {
       workflow: z5.string().max(5e5).describe("The exported workflow JSON"),
       project_name: V.name.describe("Registered project to resolve paths against"),
@@ -3504,38 +3646,38 @@ Warning: these still hold a machine-specific path and will not travel: ${residua
         };
       }
       const bundle = args.bundle ?? slugify(project.name);
-      const definition = fromPortable(
-        { ...parsed, slug: parsed.slug ?? slugify(parsed.name) },
+      const portable = { ...parsed, slug: parsed.slug ?? slugify(parsed.name) };
+      const connections = await listPortableConnections();
+      const resolved = fromPortable(
+        portable,
         bundle,
         {
           name: project.name,
           path: project.path
-        }
+        },
+        connections
       );
-      const blockers = portabilityBlockers(definition);
-      if (blockers.length > 0) {
-        return {
-          content: [
-            {
-              type: "text",
-              text: `Error: this workflow cannot be imported because ${blockers.join("; ")}.`
-            }
-          ],
-          isError: true
-        };
-      }
-      const existing = (await dbListWorkflows()).find((w) => w.id === definition.id);
+      const unresolved = unresolvedRequirements(portable, connections);
+      const known = await dbListWorkflows();
+      const id = importedWorkflowIdFor(bundle, portable.slug, portable.name, known);
+      const existing = known.find((w) => w.id === id);
+      const definition = { ...resolved, id, enabled: existing ? existing.enabled : false };
       if (existing) {
         await dbUpdateWorkflow(definition.id, definition);
       } else {
         await dbInsertWorkflow(definition);
       }
       dbSignalChange();
+      const pending = unresolved.map(
+        (requirement) => requirement.kind === "httpProfile" ? `${requirement.nodeId} needs an HTTP profile${requirement.name ? ` like "${requirement.name}"` : ""}` : `${requirement.nodeId} needs a ${requirement.connectorId || "connector"} connection${requirement.name ? ` like "${requirement.name}"` : ""}`
+      ).join("; ");
       return {
         content: [
           {
             type: "text",
-            text: `${existing ? "Updated" : "Imported"} "${definition.name}" as ${definition.id}, resolved against ${project.path}`
+            text: `${existing ? "Updated" : "Imported"} "${definition.name}" as ${definition.id}, resolved against ${project.path}` + (existing || definition.enabled ? "" : ". It is disabled; enable it when ready") + (pending ? `
+
+Still to connect: ${pending}` : "")
           }
         ]
       };
@@ -3556,7 +3698,7 @@ function registerConfigTools(server) {
 }
 
 // src/tools/workspaces.ts
-import crypto3 from "crypto";
+import crypto4 from "crypto";
 import { z as z6 } from "zod";
 function registerWorkspaceTools(server) {
   server.tool("list_workspaces", "List all workspaces", async () => {
@@ -3575,7 +3717,7 @@ function registerWorkspaceTools(server) {
       const existing = await dbListWorkspaces();
       const maxOrder = existing.reduce((max, w) => Math.max(max, w.order), 0);
       const workspace = {
-        id: crypto3.randomUUID(),
+        id: crypto4.randomUUID(),
         name: args.name,
         order: maxOrder + 1,
         ...args.icon && { icon: args.icon },
@@ -3766,10 +3908,13 @@ function registerConnectorTools(server) {
   );
   server.tool(
     "install_connector",
-    "Install a connector from the catalog or from an npm package, creating a connection ready to poll. Call list_connectors for catalog ids and inspect_connector_package to see which environment variables are needed. Secrets cannot be set this way \u2014 see the error it returns if the connector requires one.",
+    "Install a connector from a pack file, from the catalog, or from an npm package, creating a connection ready to poll. Call list_connectors for catalog ids and inspect_connector_package to see which environment variables are needed. Secrets cannot be set this way \u2014 see the error it returns if the connector requires one.",
     {
       connector_id: V.id.optional().describe("Catalog connector id (from list_connectors). Use this or package."),
       package: V.shortText.optional().describe("npm package name or launch command"),
+      pack_path: V.shortText.optional().describe(
+        "Path to a .vorn.tgz pack to install first. It is verified and copied to disk, and the connection then launches those files rather than resolving a package."
+      ),
       name: V.title.optional().describe("Connection name (defaults to the connector name)"),
       project: V.name.optional().describe("Vorn project tasks should be created in"),
       trigger: V.shortText.optional().describe("Trigger type to configure (defaults to the first the connector offers)"),
@@ -3784,8 +3929,17 @@ function registerConnectorTools(server) {
           `No connector "${args.connector_id}" in the catalog. Known: ${catalog.map((c) => c.id).join(", ") || "(none)"}. To install something not in the catalog, pass \`package\` instead.`
         );
       }
-      const target = entry ? entry.launch : args.package;
-      if (!target) return failure("Provide either connector_id or package.");
+      let installed;
+      if (args.pack_path) {
+        const outcome = await rpcCall("connector:installPack", {
+          kind: "file",
+          path: args.pack_path
+        });
+        if (!outcome.ok) return failure(`The pack was refused: ${outcome.error}`);
+        installed = outcome.pack;
+      }
+      const target = installed ? packLaunch(installed) : entry?.launch ?? args.package;
+      if (!target) return failure("Provide either connector_id, package, or pack_path.");
       const result = await probe(target);
       if (!result.ok) return failure(result.error);
       const manifest = result.manifest;
@@ -3837,6 +3991,7 @@ function registerConnectorTools(server) {
         installed: manifest.name,
         connectionId: connection2.id,
         trigger: trigger?.type,
+        ...installed && { version: installed.version, path: installed.path },
         note: "Poll it now with backfill_connection, or reference it from a workflow."
       });
     }
@@ -3874,6 +4029,9 @@ function registerConnectorTools(server) {
     }
   );
 }
+function packLaunch(pack) {
+  return { command: "node", args: [`${pack.path}/index.js`] };
+}
 async function probe(target) {
   const launch = typeof target === "string" ? parseLaunch(target) : target;
   return rpcCall("connector:probeSdk", launch, PROBE_TIMEOUT_MS);
@@ -3895,7 +4053,7 @@ function plural(count, word) {
 }
 
 // src/tools/browser.ts
-import crypto4 from "crypto";
+import crypto5 from "crypto";
 import { z as z8 } from "zod";
 function sessionId(env = process.env) {
   const id = env.VORN_SESSION_ID;
@@ -3922,7 +4080,7 @@ function source(label) {
   return label.includes("WEB PAGE") || label.includes("BROWSER") ? "page" : "device";
 }
 function pageResult(data, label = "WEB PAGE CONTENT") {
-  const nonce = crypto4.randomUUID();
+  const nonce = crypto5.randomUUID();
   return {
     content: [
       {
@@ -4177,6 +4335,7 @@ function registerDeviceTools(server) {
         sessionId: id,
         udid: args.udid
       });
+      if (!r.ok) throw new Error(r.message);
       return {
         content: [{ type: "text", text: `Claimed ${r.name} (${r.udid}).` }]
       };
@@ -4370,7 +4529,7 @@ console.warn = (...args) => _origError("[mcp:warn]", ...args);
 console.error = (...args) => _origError("[mcp:error]", ...args);
 async function main() {
   configManager.init();
-  const version = true ? "0.7.0-beta.1" : createRequire(import.meta.url)("../package.json").version;
+  const version = true ? "0.7.0-beta.11" : createRequire(import.meta.url)("../package.json").version;
   const server = createMcpServer(version);
   const transport = new StdioServerTransport();
   await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vornrun/mcp",
-  "version": "0.7.0-beta.1",
+  "version": "0.7.0-beta.11",
   "description": "Vorn MCP server — task management, git, and workflow tools for AI coding agents",
   "type": "module",
   "license": "MIT",
@@ -38,8 +38,8 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@vornrun/server": "0.7.0-beta.1",
-    "@vornrun/shared": "0.7.0-beta.1",
+    "@vornrun/server": "0.7.0-beta.11",
+    "@vornrun/shared": "0.7.0-beta.11",
     "tsup": "^8.5.1",
     "tsx": "^4.23.1",
     "typescript": "^6.0.3"