@vornrun/mcp 0.7.0-beta.9 → 0.7.0

package/dist/index.js

@@ -50,8 +50,11 @@ import fs from "fs";
 import path from "path";
 
 // ../shared/src/protocol.ts
+var CLOSE_UNAUTHENTICATED = 4001;
+var CLOSE_CREDENTIAL_REJECTED = 4002;
 var BOOTSTRAP_ENV_VAR = "SECRET_VORN_BOOTSTRAP_TOKEN";
 var LOCAL_TOKEN_FILENAME = "local-token";
+var WS_PORT_FILENAME = "ws-port";
 
 // ../shared/src/types.ts
 var DEFAULT_WORKSPACE = {
@@ -106,6 +109,7 @@ var STRIP_ENV_KEYS_UPPER = STRIP_ENV_KEYS.map((k) => k.toUpperCase());
 
 // ../server/src/default-workflows.ts
 var DEFAULT_TASK_WORKFLOW_ID = "system:default-task-workflow";
+var DEV_SERVER_WORKFLOW_ID = "system:dev-server-on-restore";
 function buildDefaultTaskWorkflow() {
   const triggerConfig = {
     triggerType: "taskStatusChanged",
@@ -145,6 +149,39 @@ function buildDefaultTaskWorkflow() {
     edges: [{ id: "e1", source: "trigger-1", target: "launch-1" }]
   };
 }
+function buildDevServerWorkflow() {
+  const triggerConfig = { triggerType: "sessionRestored" };
+  const scriptConfig = {
+    scriptType: "bash",
+    scriptContent: "yarn dev",
+    cwd: "{{context.projectPath}}"
+  };
+  return {
+    id: DEV_SERVER_WORKFLOW_ID,
+    name: "Bring the dev server back",
+    icon: "RotateCcw",
+    iconColor: "#c9972a",
+    enabled: false,
+    workspaceId: "personal",
+    nodes: [
+      {
+        id: "trigger-1",
+        type: "trigger",
+        label: "When a session is restored",
+        position: { x: 0, y: 0 },
+        config: triggerConfig
+      },
+      {
+        id: "script-1",
+        type: "script",
+        label: "Start the dev server",
+        position: { x: 0, y: 120 },
+        config: scriptConfig
+      }
+    ],
+    edges: [{ id: "e1", source: "trigger-1", target: "script-1" }]
+  };
+}
 
 // ../server/src/database.ts
 var DEFAULT_DATA_DIR = path2.join(os.homedir(), ".vorn");
@@ -163,8 +200,8 @@ function getDataDir() {
   }
   return resolvedDataDir;
 }
-function initDatabase(dataDir) {
-  resolvedDataDir = dataDir ?? DEFAULT_DATA_DIR;
+function initDatabase(dataDir2) {
+  resolvedDataDir = dataDir2 ?? DEFAULT_DATA_DIR;
   if (!fs2.existsSync(getDataDir())) {
     fs2.mkdirSync(getDataDir(), { recursive: true, mode: 448 });
   }
@@ -189,17 +226,25 @@ function initDatabase(dataDir) {
   }
 }
 function seedSystemDefaults() {
+  seedWorkflowOnce(
+    "hasSeededDefaultTaskWorkflow",
+    DEFAULT_TASK_WORKFLOW_ID,
+    buildDefaultTaskWorkflow
+  );
+  seedWorkflowOnce("hasSeededDevServerWorkflow", DEV_SERVER_WORKFLOW_ID, buildDevServerWorkflow);
+}
+function seedWorkflowOnce(flag, id, build) {
   const d = getDb();
-  const flagRow = d.prepare("SELECT value FROM defaults WHERE key = 'hasSeededDefaultTaskWorkflow'").get();
+  const flagRow = d.prepare("SELECT value FROM defaults WHERE key = ?").get(flag);
   if (flagRow) {
     try {
       if (JSON.parse(flagRow.value) === true) return;
     } catch {
     }
   }
-  const existing = d.prepare("SELECT id FROM workflows WHERE id = ?").get(DEFAULT_TASK_WORKFLOW_ID);
+  const existing = d.prepare("SELECT id FROM workflows WHERE id = ?").get(id);
   if (!existing) {
-    const w = buildDefaultTaskWorkflow();
+    const w = build();
     d.prepare(
       `INSERT INTO workflows (id, name, icon, icon_color, nodes, edges, enabled, last_run_at, last_run_status, stagger_delay_ms, workspace_id)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
@@ -216,11 +261,12 @@ function seedSystemDefaults() {
       w.staggerDelayMs ?? null,
       w.workspaceId ?? "personal"
     );
-    logger_default.info(`[database] Seeded default task workflow (${DEFAULT_TASK_WORKFLOW_ID})`);
+    logger_default.info(`[database] Seeded workflow ${id}`);
   }
-  d.prepare(
-    "INSERT OR REPLACE INTO defaults (key, value) VALUES ('hasSeededDefaultTaskWorkflow', ?)"
-  ).run(JSON.stringify(true));
+  d.prepare("INSERT OR REPLACE INTO defaults (key, value) VALUES (?, ?)").run(
+    flag,
+    JSON.stringify(true)
+  );
 }
 function recoverCorruptDatabase() {
   try {
@@ -393,7 +439,8 @@ function createSchema() {
       saved_at INTEGER,
       sort_order INTEGER NOT NULL DEFAULT 0,
       worktree_name TEXT,
-      agent_session_id TEXT
+      agent_session_id TEXT,
+      renamed_by_person INTEGER
     );
 
     CREATE TABLE IF NOT EXISTS schedule_log (
@@ -417,6 +464,16 @@ function createSchema() {
       "order" INTEGER NOT NULL DEFAULT 0
     );
 
+    CREATE TABLE IF NOT EXISTS session_groups (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      icon TEXT,
+      icon_color TEXT,
+      "order" INTEGER NOT NULL DEFAULT 0,
+      workspace_id TEXT NOT NULL DEFAULT 'personal',
+      row_revision INTEGER NOT NULL DEFAULT 0
+    );
+
     CREATE TABLE IF NOT EXISTS workflow_runs (
       id TEXT PRIMARY KEY,
       workflow_id TEXT NOT NULL,
@@ -451,6 +508,10 @@ function createSchema() {
       output TEXT,
       structured_output TEXT,
       iteration INTEGER,
+      worktree_path TEXT,
+      worktree_name TEXT,
+      worktree_origin TEXT,
+      waiting_for TEXT,
       FOREIGN KEY (run_id) REFERENCES workflow_runs(id) ON DELETE CASCADE
     );
 
@@ -691,7 +752,9 @@ function migrateSchema(d) {
           last_sync_at TEXT,
           last_sync_error TEXT,
           sync_cursor TEXT,
-          created_at TEXT NOT NULL
+          created_at TEXT NOT NULL,
+          signed_in_as TEXT,
+          signed_in_at TEXT
         )
       `);
       d.exec(`
@@ -937,11 +1000,52 @@ function migrateSchema(d) {
     })();
     logger_default.info("[database] migrated schema to version 17 (packaged connector task ids)");
   }
+  if (version < 18) {
+    d.transaction(() => {
+      const sessionCols = d.prepare("PRAGMA table_info(sessions)").all();
+      if (!sessionCols.some((c) => c.name === "group_id")) {
+        d.exec("ALTER TABLE sessions ADD COLUMN group_id TEXT");
+      }
+      d.prepare(
+        "INSERT OR REPLACE INTO schema_meta (key, value) VALUES ('schema_version', '18')"
+      ).run();
+    })();
+    logger_default.info("[database] migrated schema to version 18 (session groups)");
+  }
+  if (version < 19) {
+    d.transaction(() => {
+      const cols = d.prepare("PRAGMA table_info(workflow_run_nodes)").all();
+      for (const column of ["worktree_path", "worktree_name", "worktree_origin"]) {
+        if (!cols.some((c) => c.name === column)) {
+          d.exec(`ALTER TABLE workflow_run_nodes ADD COLUMN ${column} TEXT`);
+        }
+      }
+      d.prepare(
+        "INSERT OR REPLACE INTO schema_meta (key, value) VALUES ('schema_version', '19')"
+      ).run();
+    })();
+    logger_default.info("[database] migrated schema to version 19 (worktrees on run steps)");
+  }
+  if (version < 20) {
+    d.transaction(() => {
+      const cols = d.prepare("PRAGMA table_info(source_connections)").all();
+      for (const column of ["signed_in_as", "signed_in_at"]) {
+        if (!cols.some((c) => c.name === column)) {
+          d.exec(`ALTER TABLE source_connections ADD COLUMN ${column} TEXT`);
+        }
+      }
+      d.prepare(
+        "INSERT OR REPLACE INTO schema_meta (key, value) VALUES ('schema_version', '20')"
+      ).run();
+    })();
+    logger_default.info("[database] migrated schema to version 20 (who a connection is signed in as)");
+  }
 }
 var REVISIONED_TABLES = [
   "projects",
   "tasks",
   "workspaces",
+  "session_groups",
   "remote_hosts",
   "agent_commands"
 ];
@@ -978,9 +1082,15 @@ function verifySchema(d) {
         column: "sort_order",
         ddl: "ALTER TABLE sessions ADD COLUMN sort_order INTEGER NOT NULL DEFAULT 0"
       },
+      { column: "group_id", ddl: "ALTER TABLE sessions ADD COLUMN group_id TEXT" },
       { column: "worktree_name", ddl: "ALTER TABLE sessions ADD COLUMN worktree_name TEXT" },
       { column: "agent_session_id", ddl: "ALTER TABLE sessions ADD COLUMN agent_session_id TEXT" },
-      { column: "shell_cwd", ddl: "ALTER TABLE sessions ADD COLUMN shell_cwd TEXT" }
+      { column: "shell_cwd", ddl: "ALTER TABLE sessions ADD COLUMN shell_cwd TEXT" },
+      { column: "head_commit", ddl: "ALTER TABLE sessions ADD COLUMN head_commit TEXT" },
+      {
+        column: "renamed_by_person",
+        ddl: "ALTER TABLE sessions ADD COLUMN renamed_by_person INTEGER"
+      }
     ],
     agent_commands: [
       {
@@ -1014,6 +1124,7 @@ function verifySchema(d) {
       }
     ],
     workflow_run_nodes: [
+      { column: "waiting_for", ddl: "ALTER TABLE workflow_run_nodes ADD COLUMN waiting_for TEXT" },
       { column: "agent_type", ddl: "ALTER TABLE workflow_run_nodes ADD COLUMN agent_type TEXT" },
       {
         column: "project_name",
@@ -1093,6 +1204,7 @@ function loadConfig() {
   const remoteHosts = loadRemoteHosts(d);
   const tasks = loadTasks(d);
   const workspaces = loadWorkspaces(d);
+  const sessionGroups = loadSessionGroups(d);
   return {
     version: 1,
     revision: readConfigRevision(d),
@@ -1102,7 +1214,8 @@ function loadConfig() {
     workflows,
     remoteHosts,
     tasks,
-    workspaces
+    workspaces,
+    sessionGroups
   };
 }
 function loadDefaults(d) {
@@ -1135,6 +1248,8 @@ function loadDefaults(d) {
     // terminal drew and waits. There is nothing to ask, and leaving it off made
     // the whole thing invisible unless somebody went looking for a toggle.
     reopenSessions: map.reopenSessions ?? true,
+    // Off by default: nothing starts itself because someone installed an app.
+    startAtLogin: map.startAtLogin ?? false,
     // Saving iterates over every key in defaults, but loading is this explicit
     // list — so a key missing here round-trips to nothing and its feature is
     // silently inert.
@@ -1187,6 +1302,9 @@ function loadDefaults(d) {
     ...map.headlessRetentionMinutes !== void 0 && {
       headlessRetentionMinutes: map.headlessRetentionMinutes
     },
+    ...map.hasSeededDevServerWorkflow !== void 0 && {
+      hasSeededDevServerWorkflow: map.hasSeededDevServerWorkflow
+    },
     ...map.hasSeededDefaultTaskWorkflow !== void 0 && {
       hasSeededDefaultTaskWorkflow: map.hasSeededDefaultTaskWorkflow
     },
@@ -1250,6 +1368,10 @@ function loadTasks(d) {
   const rows = d.prepare('SELECT * FROM tasks ORDER BY "order"').all();
   return rows.map(rowToTask);
 }
+function loadSessionGroups(d) {
+  const rows = d.prepare('SELECT * FROM session_groups ORDER BY "order"').all();
+  return rows.map(rowToSessionGroup);
+}
 function loadWorkspaces(d) {
   const rows = d.prepare('SELECT * FROM workspaces ORDER BY "order"').all();
   return rows.map(rowToWorkspace);
@@ -1489,6 +1611,36 @@ function saveConfig(config) {
     for (const ws of workspaces) {
       insertWorkspace.run(ws.id, ws.name, ws.icon ?? null, ws.iconColor ?? null, ws.order, revision);
     }
+    const sessionGroups = config.sessionGroups ?? [];
+    pruneMissing(
+      d,
+      "session_groups",
+      "id",
+      sessionGroups.map((g) => g.id),
+      baseRevision
+    );
+    const insertSessionGroup = d.prepare(
+      `INSERT INTO session_groups (id, name, icon, icon_color, "order", workspace_id, row_revision)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET
+         row_revision = excluded.row_revision,
+         name = excluded.name,
+         icon = excluded.icon,
+         icon_color = excluded.icon_color,
+         "order" = excluded."order",
+         workspace_id = excluded.workspace_id`
+    );
+    for (const g of sessionGroups) {
+      insertSessionGroup.run(
+        g.id,
+        g.name,
+        g.icon ?? null,
+        g.iconColor ?? null,
+        g.order,
+        g.workspaceId,
+        revision
+      );
+    }
     d.prepare("INSERT OR REPLACE INTO schema_meta (key, value) VALUES (?, ?)").run(
       CONFIG_REVISION_KEY,
       String(revision)
@@ -1546,6 +1698,16 @@ function rowToWorkflow(r) {
     workspaceId: r.workspace_id ?? "personal"
   };
 }
+function rowToSessionGroup(r) {
+  return {
+    id: r.id,
+    name: r.name,
+    ...r.icon != null && { icon: r.icon },
+    ...r.icon_color != null && { iconColor: r.icon_color },
+    order: r.order,
+    workspaceId: r.workspace_id ?? "personal"
+  };
+}
 function rowToWorkspace(r) {
   return {
     id: r.id,
@@ -1562,8 +1724,8 @@ var ConfigManager = class {
   dbWatcher = null;
   debounceTimer = null;
   cachedConfig = null;
-  init(dataDir) {
-    initDatabase(dataDir);
+  init(dataDir2) {
+    initDatabase(dataDir2);
   }
   close() {
     this.stopWatchingDb();
@@ -1681,33 +1843,47 @@ var V = {
   url: safeUrl
 };
 
-// src/ws-client.ts
+// ../server/src/rpc-client.ts
 import fs4 from "fs";
 import path3 from "path";
 import os2 from "os";
 import { execFileSync as execFileSync2 } from "child_process";
 import { WebSocket } from "ws";
-var DATA_DIR = process.env.VORN_DATA_DIR || path3.join(os2.homedir(), ".vorn");
-var PORT_FILE = path3.join(DATA_DIR, "ws-port");
-var LOCAL_TOKEN_FILE = path3.join(DATA_DIR, LOCAL_TOKEN_FILENAME);
-var TOKEN_FILE_MISSING_MSG = `Vorn local credential not found (${LOCAL_TOKEN_FILE}).
+var dataDirOverride;
+function named(value) {
+  return value?.trim() ? value : void 0;
+}
+function dataDir() {
+  return dataDirOverride ?? named(process.env.VORN_DATA_DIR) ?? path3.join(os2.homedir(), ".vorn");
+}
+function portFile() {
+  return path3.join(dataDir(), WS_PORT_FILENAME);
+}
+function localTokenFile() {
+  return path3.join(dataDir(), LOCAL_TOKEN_FILENAME);
+}
+function tokenFileMissingMessage() {
+  return `Vorn local credential not found (${localTokenFile()}).
 The server writes it on startup and removes it on shutdown, so this usually means
-Vorn is not running. Start Vorn (or \`vorn-server serve\`) and try again.
-If the server runs with --data-dir, set VORN_DATA_DIR to the same directory.`;
+Vorn is not running. Start Vorn (or \`vorn server serve\`) and try again.
+If the server runs with --data-dir, pass the same --data-dir here, or set
+VORN_DATA_DIR to that directory -- which is how anything that is not the CLI,
+MCP included, reaches a server that moved.`;
+}
 function readLocalToken() {
   try {
-    const token = fs4.readFileSync(LOCAL_TOKEN_FILE, "utf-8").trim();
+    const token = fs4.readFileSync(localTokenFile(), "utf-8").trim();
     if (!token) throw new Error("empty");
     return token;
   } catch {
-    throw new Error(TOKEN_FILE_MISSING_MSG);
+    throw new Error(tokenFileMissingMessage());
   }
 }
 function connection() {
   const result = readPort();
   if (!result.port) {
     const reason = "reason" in result ? result.reason : "missing";
-    throw new Error(reason === "invalid" ? PORT_FILE_INVALID_MSG : PORT_FILE_MISSING_MSG);
+    throw new Error(reason === "invalid" ? portFileInvalidMessage() : portFileMissingMessage());
   }
   return {
     url: `ws://127.0.0.1:${result.port}/ws`,
@@ -1716,21 +1892,42 @@ function connection() {
 }
 var TIMEOUT_MS = 1e4;
 var IS_WIN = process.platform === "win32";
-var PORT_FILE_MISSING_MSG = IS_WIN ? `Vorn port file not found (~/.vorn/ws-port).
+function portFileMissingMessage() {
+  const file = portFile();
+  return IS_WIN ? `Vorn port file not found (${file}).
 The app may be running but the port file was deleted (e.g. by another instance shutting down).
-To fix, find the Vorn process and its listening port:
-  powershell -c "Get-NetTCPConnection -State Listen -OwningProcess (Get-Process Vorn).Id | Select LocalPort"
+To fix, in PowerShell, find the Vorn process and its listening port:
+  Get-NetTCPConnection -State Listen -OwningProcess (Get-Process Vorn).Id | Select LocalPort
 Then write the WS port to the file:
-  echo {"port":<PORT>,"pid":<PID>} > %USERPROFILE%\\.vorn\\ws-port
-Or restart Vorn to regenerate it.` : `Vorn port file not found (~/.vorn/ws-port).
+  '{"port":<PORT>,"pid":<PID>}' | Set-Content -Path "${file}"
+Or restart Vorn to regenerate it.` : `Vorn port file not found (${file}).
 The app may be running but the port file was deleted (e.g. by another instance shutting down).
 To fix, run:  lsof -iTCP -sTCP:LISTEN -P | grep Vorn
 Then write the WS port (the one on *:<port>) to the file:
-  echo '{"port":<PORT>,"pid":<PID>}' > ~/.vorn/ws-port
+  echo '{"port":<PORT>,"pid":<PID>}' > "${file}"
 Or restart Vorn to regenerate it.`;
-var PORT_FILE_INVALID_MSG = `Vorn port file exists but contains invalid data (~/.vorn/ws-port).
+}
+function portFileInvalidMessage() {
+  const file = portFile();
+  return `Vorn port file exists but contains invalid data (${file}).
 Delete it and restart Vorn, or overwrite it with the correct port:
-  ${IS_WIN ? "del %USERPROFILE%\\.vorn\\ws-port" : "rm ~/.vorn/ws-port"}`;
+  ${IS_WIN ? `Remove-Item "${file}"` : `rm "${file}"`}`;
+}
+function closedBeforeAnswering(code) {
+  if (code === CLOSE_UNAUTHENTICATED || code === CLOSE_CREDENTIAL_REJECTED) {
+    return `A Vorn server on this port refused the credential in ${localTokenFile()}.
+Another server is listening on it with its own data directory, which a dev build
+running beside the app does. Point at that one with --data-dir (or VORN_DATA_DIR),
+or stop it.`;
+  }
+  return `The server closed the connection before answering (code ${code}).`;
+}
+function explain(message) {
+  if (!message.startsWith("Method not found:")) return message;
+  const method = message.slice("Method not found:".length).trim();
+  return `This server does not have ${method}, so it is older than the vorn command asking for it.
+Restart Vorn to pick up the newer server, or run this against the matching build.`;
+}
 var rpcId = 0;
 var cachedPort = null;
 var cacheTimestamp = 0;
@@ -1783,7 +1980,11 @@ function discoverPort() {
   }
   return null;
 }
+function discoveryAllowed() {
+  return dataDirOverride === void 0 && named(process.env.VORN_DATA_DIR) === void 0;
+}
 function discoverAndHeal() {
+  if (!discoveryAllowed()) return { port: null, reason: "missing" };
   const now = Date.now();
   if (cachedPort && now - cacheTimestamp < CACHE_TTL_MS) return { port: cachedPort };
   const discovered = discoverPort();
@@ -1791,8 +1992,8 @@ function discoverAndHeal() {
   cacheTimestamp = now;
   if (discovered) {
     try {
-      fs4.mkdirSync(path3.dirname(PORT_FILE), { recursive: true });
-      fs4.writeFileSync(PORT_FILE, JSON.stringify({ port: discovered }), "utf-8");
+      fs4.mkdirSync(dataDir(), { recursive: true });
+      fs4.writeFileSync(portFile(), JSON.stringify({ port: discovered }), "utf-8");
     } catch {
     }
     return { port: discovered };
@@ -1801,7 +2002,7 @@ function discoverAndHeal() {
 }
 function readPort() {
   try {
-    const raw = fs4.readFileSync(PORT_FILE, "utf-8").trim();
+    const raw = fs4.readFileSync(portFile(), "utf-8").trim();
     if (!raw) return { port: null, reason: "invalid" };
     if (raw.startsWith("{")) {
       const parsed = JSON.parse(raw);
@@ -1843,15 +2044,19 @@ async function rpcCall(method, params, timeoutMs = TIMEOUT_MS) {
         const msg = JSON.parse(raw.toString());
         if (msg.id !== id) return;
         clearTimeout(timer);
-        ws.close();
         if (msg.error) {
-          reject(new Error(msg.error.message));
+          reject(new Error(explain(msg.error.message)));
         } else {
           resolve(msg.result);
         }
+        ws.close();
       } catch {
       }
     });
+    ws.on("close", (code) => {
+      clearTimeout(timer);
+      reject(new Error(closedBeforeAnswering(code)));
+    });
     ws.on("error", (err) => {
       clearTimeout(timer);
       reject(new Error(`Cannot connect to Vorn server: ${err.message}. Is the app running?`));
@@ -1980,6 +2185,9 @@ async function listWorkflowRunsByTask(taskId, limit = 20) {
     limit
   });
 }
+async function listRunsWithWaitingGates() {
+  return rpcCall("workflowRun:listWaiting");
+}
 async function listAllWorkflowRuns(workspaceId, limit = 50) {
   return rpcCall("workflowRun:listAll", {
     workspaceId,
@@ -2750,6 +2958,13 @@ function registerSessionTools(server) {
 
 // src/tools/workflows.ts
 import crypto3 from "crypto";
+
+// ../shared/src/workflow-graph.ts
+function isSignInWait(state) {
+  return state.status === "waiting" && state.waitingFor === "signIn";
+}
+
+// src/tools/workflows.ts
 import { z as z5 } from "zod";
 
 // ../shared/src/workflow-portability.ts
@@ -2780,16 +2995,18 @@ function boundConnectionKey(node, config) {
   if (node.type === "trigger" && config.triggerType === "connectorPoll") return "connectionId";
   if (node.type === "callConnectorAction") return "connectionId";
   if (node.type === "httpRequest") return "profileConnectionId";
+  if (node.type === "script") return "secretsFrom";
   return null;
 }
+var OPTIONAL_CONNECTION_KEYS = /* @__PURE__ */ new Set(["profileConnectionId", "secretsFrom"]);
 function resolveRequirement(requirement, connections) {
   const candidates = connections.filter(
     (connection2) => requirement.kind === "httpProfile" ? connectorOf(connection2) === HTTP_PROFILE_CONNECTOR : requirement.connectorId !== "" && connectorOf(connection2) === requirement.connectorId
   );
   if (candidates.length === 0) return void 0;
   if (requirement.name !== "") {
-    const named = candidates.filter((connection2) => connection2.name === requirement.name);
-    if (named.length === 1) return named[0].id;
+    const named2 = candidates.filter((connection2) => connection2.name === requirement.name);
+    if (named2.length === 1) return named2[0].id;
   }
   return candidates.length === 1 ? candidates[0].id : void 0;
 }
@@ -2810,11 +3027,10 @@ function toPortable(workflow, projectPath, connections = []) {
         config[`projectName`] = PROJECT_NAME_TOKEN;
       }
       delete config.remoteHostId;
-      delete config.secretsFrom;
     }
     const key = boundConnectionKey(node, config);
     const bound = key === null ? "" : config[key];
-    const unbound = key !== null && key !== "profileConnectionId" && bound === "";
+    const unbound = key !== null && !OPTIONAL_CONNECTION_KEYS.has(key) && bound === "";
     if (key !== null && (typeof bound === "string" && bound !== "" || unbound)) {
       const source2 = connections.find((connection2) => connection2.id === bound);
       const event = config.event;
@@ -2825,10 +3041,11 @@ function toPortable(workflow, projectPath, connections = []) {
           nodeId: node.id,
           connectorId: source2 ? connectorOf(source2) : typeof declared === "string" ? declared : "",
           name: source2?.name ?? "",
-          ...typeof event === "string" && event !== "" && { event }
+          ...typeof event === "string" && event !== "" && { event },
+          ...key === "secretsFrom" && { key }
         }
       );
-      if (key === "profileConnectionId") delete config[key];
+      if (OPTIONAL_CONNECTION_KEYS.has(key)) delete config[key];
       else config[key] = "";
     }
     return { ...node, config };
@@ -2859,9 +3076,12 @@ function replacePath(value, projectPath) {
 function unresolvedRequirements(portable, connections) {
   const present = new Set(portable.nodes.map((node) => node.id));
   return (portable.requires ?? []).filter(
-    (requirement) => present.has(requirement.nodeId) && resolveRequirement(requirement, connections) === void 0
+    (requirement) => present.has(requirement.nodeId) && (bindsOnlyByHand(requirement) || resolveRequirement(requirement, connections) === void 0)
   );
 }
+function bindsOnlyByHand(requirement) {
+  return requirement.kind === "connection" && requirement.key === "secretsFrom";
+}
 function fromPortable(portable, bundle, project, connections = [], mintToken = () => crypto.randomUUID()) {
   const bindings = /* @__PURE__ */ new Map();
   for (const requirement of portable.requires ?? []) {
@@ -2869,16 +3089,16 @@ function fromPortable(portable, bundle, project, connections = [], mintToken = (
   }
   const nodes = portable.nodes.map((node) => {
     const config = { ...node.config };
-    delete config.secretsFrom;
-    for (const [key, value] of Object.entries(config)) {
+    const key = boundConnectionKey(node, config);
+    if (key !== null && OPTIONAL_CONNECTION_KEYS.has(key)) delete config[key];
+    for (const [key2, value] of Object.entries(config)) {
       if (typeof value !== "string") continue;
-      config[key] = value.split(PROJECT_PATH_TOKEN).join(project.path.replace(/[/\\]+$/, "")).split(PROJECT_NAME_TOKEN).join(project.name);
+      config[key2] = value.split(PROJECT_PATH_TOKEN).join(project.path.replace(/[/\\]+$/, "")).split(PROJECT_NAME_TOKEN).join(project.name);
     }
     for (const requirement of bindings.get(node.id) ?? []) {
+      if (bindsOnlyByHand(requirement) || key === null) continue;
       const resolved = resolveRequirement(requirement, connections);
-      if (resolved === void 0) continue;
-      if (requirement.kind === "httpProfile") config.profileConnectionId = resolved;
-      else config.connectionId = resolved;
+      if (resolved !== void 0) config[key] = resolved;
     }
     if (node.type === "trigger" && config.triggerType === "webhook" && !config.token) {
       config.token = mintToken();
@@ -3200,6 +3420,64 @@ function resolveWorkflowId(args) {
   }
   return { id };
 }
+function approvalNode(workflow, nodeId) {
+  return workflow?.nodes.find((n) => n.id === nodeId && n.type === "approval");
+}
+function askedBy(node) {
+  return node?.config?.message?.trim() || void 0;
+}
+function gateMessage(workflow, nodeId) {
+  return askedBy(approvalNode(workflow, nodeId));
+}
+function annotateWaitingGates(runs, workflows) {
+  return runs.map((run) => {
+    if (!run.nodeStates.some((n) => n.status === "waiting")) return run;
+    const workflow = workflows.find((w) => w.id === run.workflowId);
+    return {
+      ...run,
+      nodeStates: run.nodeStates.map((state) => {
+        if (state.status !== "waiting") return state;
+        if (isSignInWait(state)) {
+          return {
+            ...state,
+            asks: "Sign in to its connection in the Vorn app, and this step runs again"
+          };
+        }
+        const asks = gateMessage(workflow, state.nodeId);
+        return asks ? { ...state, asks } : state;
+      })
+    };
+  });
+}
+async function runById(runId) {
+  const recent = (await listAllWorkflowRuns(void 0, 500)).find((r) => r.runId === runId);
+  if (recent) return recent;
+  return (await listRunsWithWaitingGates()).find((r) => r.runId === runId);
+}
+function resolveGateTarget(run, nodeId, decision = "approve") {
+  const parked = run.nodeStates.filter((n) => n.status === "waiting");
+  const answerable = parked.filter((n) => decision === "reject" || !isSignInWait(n));
+  const waiting = answerable.map((n) => n.nodeId);
+  const signIns = parked.filter((n) => !answerable.includes(n)).map((n) => n.nodeId);
+  if (nodeId) {
+    if (signIns.includes(nodeId)) {
+      return {
+        error: `node "${nodeId}" is waiting for a sign-in in the Vorn app, not for an approval`
+      };
+    }
+    if (waiting.includes(nodeId)) return { nodeId };
+    return {
+      error: waiting.length ? `node "${nodeId}" is not waiting. Waiting: ${waiting.join(", ")}` : `node "${nodeId}" is not waiting, and neither is any other node in this run`
+    };
+  }
+  if (waiting.length === 1) return { nodeId: waiting[0] };
+  if (waiting.length === 0) {
+    return {
+      error: signIns.length ? "this run is waiting for a sign-in in the Vorn app, not for an approval" : "no node in this run is waiting on a gate"
+    };
+  }
+  return { error: `${waiting.length} nodes are waiting \u2014 pass node_id: ${waiting.join(", ")}` };
+}
 async function listPortableConnections() {
   try {
     return await rpcCall("connection:list", { connectorId: void 0 });
@@ -3353,7 +3631,7 @@ function registerWorkflowTools(server) {
   );
   server.tool(
     "list_workflow_runs",
-    "List workflow execution history. Filter by workflow_id or task_id.",
+    "List workflow execution history. Filter by workflow_id or task_id; with neither, lists the runs parked on an approval gate, each waiting node saying what it asks.",
     {
       workflow_id: V.id.optional().describe("Filter by workflow ID"),
       task_id: V.id.optional().describe("Filter by task ID (runs triggered by this task)"),
@@ -3366,28 +3644,28 @@ function registerWorkflowTools(server) {
           isError: true
         };
       }
+      const withGates = async (runs) => runs.some((r) => r.nodeStates.some((n) => n.status === "waiting")) ? annotateWaitingGates(runs, await dbListWorkflows()) : runs;
       if (args.task_id) {
-        const runs = await listWorkflowRunsByTask(args.task_id, args.limit ?? 20);
+        const runs = await withGates(await listWorkflowRunsByTask(args.task_id, args.limit ?? 20));
         return { content: [{ type: "text", text: JSON.stringify(runs, null, 2) }] };
       }
       if (args.workflow_id) {
-        const runs = await listWorkflowRuns(args.workflow_id, args.limit ?? 20);
+        const runs = await withGates(await listWorkflowRuns(args.workflow_id, args.limit ?? 20));
         return { content: [{ type: "text", text: JSON.stringify(runs, null, 2) }] };
       }
-      return {
-        content: [{ type: "text", text: "Error: provide either workflow_id or task_id" }],
-        isError: true
-      };
+      const parked = (await listRunsWithWaitingGates()).slice(0, args.limit ?? 20);
+      const waiting = await withGates(parked);
+      return { content: [{ type: "text", text: JSON.stringify(waiting, null, 2) }] };
     }
   );
   server.tool(
     "stop_workflow_run",
-    "Stop a workflow run that is still going, including one parked on an approval gate. Kills the agents it started, marks its unfinished nodes, and closes the run as cancelled. Requires the Vorn app to be running. A workflow will not start a new run while an old one sits waiting for approval, so this is how you clear that.",
+    "Stop a workflow run that is still going, including one parked on an approval gate. Kills the agents it started, marks its unfinished nodes, and closes the run as cancelled. Requires the Vorn app to be running.",
     {
       run_id: V.id.describe("Run ID (from list_workflow_runs)")
     },
     async (args) => {
-      const run = (await listAllWorkflowRuns(void 0, 500)).find((r) => r.runId === args.run_id);
+      const run = await runById(args.run_id);
       if (!run) {
         return {
           content: [
@@ -3432,6 +3710,74 @@ The run is stopped by the instance holding it, so confirm with list_workflow_run
       };
     }
   );
+  server.tool(
+    "resolve_gate",
+    "Approve or reject the approval gate a workflow run is parked on, the way the Vorn app does. Requires the Vorn app to be running: the decision is broadcast, and the instance holding the run is what resumes it. Read what is being approved first \u2014 list_workflow_runs names the waiting node and what it asks.",
+    {
+      run_id: V.id.describe("Run ID (from list_workflow_runs)"),
+      decision: z5.enum(["approve", "reject"]).describe("approve lets the run go on; reject ends it"),
+      node_id: V.id.optional().describe("The waiting node, when a run has more than one gate open")
+    },
+    async (args) => {
+      const run = await runById(args.run_id);
+      if (!run) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: no run "${args.run_id}" in the recent history, and none parked on a gate. Check list_workflow_runs.`
+            }
+          ],
+          isError: true
+        };
+      }
+      if (run.status !== "running") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Run ${args.run_id} already finished (${run.status}) \u2014 no gate to answer.`
+            }
+          ]
+        };
+      }
+      const target = resolveGateTarget(run, args.node_id, args.decision);
+      if ("error" in target) {
+        return {
+          content: [{ type: "text", text: `Error: ${target.error}` }],
+          isError: true
+        };
+      }
+      const workflow = (await dbListWorkflows()).find((w) => w.id === run.workflowId);
+      const gateNode = approvalNode(workflow, target.nodeId);
+      const asked = askedBy(gateNode);
+      try {
+        await rpcCall("workflow:resolveGate", {
+          runId: args.run_id,
+          nodeId: target.nodeId,
+          decision: args.decision
+        });
+      } catch (err) {
+        return {
+          content: [{ type: "text", text: `Error: ${err instanceof Error ? err.message : err}` }],
+          isError: true
+        };
+      }
+      const gate = gateNode?.label ?? target.nodeId;
+      return {
+        content: [
+          {
+            type: "text",
+            text: `${args.decision === "approve" ? "Approved" : "Rejected"} "${gate}" on run ${args.run_id}${run.workflowName ? ` of "${run.workflowName}"` : ""}.${asked ? `
+
+What it asked: ${asked}` : ""}
+
+The decision went out; the instance holding the run acts on it, so a desktop has to be open. Confirm with list_workflow_runs.`
+          }
+        ]
+      };
+    }
+  );
   server.tool(
     "get_workflow_schedule",
     "Get scheduler info for a workflow: execution log or next scheduled run. Requires the Vorn app to be running.",
@@ -3472,7 +3818,7 @@ The run is stopped by the instance holding it, so confirm with list_workflow_run
   );
   server.tool(
     "execute_workflow",
-    "Run a workflow now, as if triggered manually. Supply values for any parameters the workflow declares (see the trigger node's inputs); declared defaults fill in anything omitted. Requires the Vorn app to be running. Returns as soon as the run is queued \u2014 poll list_workflow_runs for the outcome.",
+    "Run a workflow now, as if triggered manually. Supply values for any parameters the workflow declares (see the trigger node's inputs); declared defaults fill in anything omitted. Requires the Vorn app to be running. Returns as soon as the run is queued \u2014 poll list_workflow_runs for the outcome. Runs of one workflow go side by side; only a run repeating one started in the last ten seconds with the same inputs is refused as a duplicate.",
     {
       workflow_id: V.id.describe("Workflow ID (from list_workflows)"),
       inputs: z5.record(z5.string(), z5.union([z5.string(), z5.number(), z5.boolean()])).optional().describe("Values for the declared parameters, keyed by input key ({{inputs.<key>}})")
@@ -3791,27 +4137,43 @@ var failure = (message) => ({
 function summarize(entry) {
   return { type: entry.type, label: entry.label };
 }
+function andList(values) {
+  if (values.length <= 1) return values[0] ?? "";
+  return `${values.slice(0, -1).join(", ")} and ${values[values.length - 1]}`;
+}
+function contributionSummary(contributes) {
+  const named2 = (entries) => (entries ?? []).map((entry) => ({ id: entry.id, title: entry.title }));
+  return {
+    panes: named2(contributes?.panes),
+    footers: named2(contributes?.footers),
+    linkHandlers: named2(contributes?.linkHandlers)
+  };
+}
 function registerConnectorTools(server) {
   server.tool(
     "list_connectors",
-    "List every connector: the ones built into Vorn, the ones installable from a package, and how many connections each already has. Use this before creating a workflow that calls a connector action, or to find the id of a connector to install.",
+    "List every connector and extension: the ones built into Vorn, the ones installable from a package, and how many connections each already has. A connector polls a service; an extension adds footers and panes to a session card and says what it may touch. Use this before creating a workflow that calls a connector action, or to find an id to install.",
     {
-      installable_only: z7.boolean().optional().describe("Only connectors that are not set up yet")
+      installable_only: z7.boolean().optional().describe("Only connectors that are not set up yet"),
+      kind: z7.enum(["connector", "extension"]).optional().describe("Only one kind: what polls a service, or what shows on a card")
     },
     async (args) => {
-      const [builtIns, snapshot, connections, statuses] = await Promise.all([
+      const [builtIns, snapshot, connections, statuses, packs] = await Promise.all([
         rpcCall("connector:list"),
         rpcCall("connector:catalog"),
         rpcCall("connection:list", { connectorId: void 0 }),
-        rpcCall("connector:status")
+        rpcCall("connector:status"),
+        rpcCall("connector:listPacks")
       ]);
       const countFor = (id) => connections.filter((conn) => connectionConnectorId(conn) === id).length;
       const statusFor = (id) => statuses.find((s) => s.connectorId === id);
+      const packFor = (id) => packs.find((pack) => pack.id === id);
       const entries = [
         ...builtIns.map((c) => ({
           id: c.id,
           name: c.name,
           source: "built-in",
+          kind: "connector",
           capabilities: c.capabilities,
           connections: countFor(c.id),
           // Only meaningful for connectors that authenticate up front; the
@@ -3821,25 +4183,49 @@ function registerConnectorTools(server) {
             ...statusFor(c.id).message && { authMessage: statusFor(c.id).message }
           }
         })),
-        ...snapshot.items.map((entry) => ({
-          id: entry.id,
-          name: entry.name,
-          source: "package",
-          description: entry.description,
-          package: entry.packageName,
-          ...entry.version && { version: entry.version },
-          capabilities: entry.capabilities,
-          connections: countFor(entry.id),
-          ...entry.auth && { auth: entry.auth },
-          // Generated upstream from the connector's own manifest, so an agent
-          // can tell whether a connector is worth installing without launching
-          // it — which for a list of twenty would be twenty npx processes.
-          ...entry.triggers && { triggers: entry.triggers.map(summarize) },
-          ...entry.actions && { actions: entry.actions.map(summarize) },
-          ...entry.env && { env: entry.env.map((e) => e.name) }
-        }))
+        ...snapshot.items.map((entry) => {
+          const pack = packFor(entry.id);
+          const kind = pack?.kind ?? entry.kind ?? "connector";
+          return {
+            id: entry.id,
+            name: entry.name,
+            source: "package",
+            kind,
+            description: entry.description,
+            package: entry.packageName,
+            ...entry.version && { version: entry.version },
+            capabilities: entry.capabilities,
+            connections: countFor(entry.id),
+            ...pack && { installed: pack.version },
+            ...entry.auth && { auth: entry.auth },
+            // Generated upstream from the connector's own manifest, so an agent
+            // can tell whether a connector is worth installing without launching
+            // it — which for a list of twenty would be twenty npx processes.
+            ...entry.triggers && { triggers: entry.triggers.map(summarize) },
+            ...entry.actions && { actions: entry.actions.map(summarize) },
+            ...entry.env && { env: entry.env.map((e) => e.name) },
+            // Only what was stated: an empty list would read as "adds nothing",
+            // which is a claim an older catalog never made.
+            ...kind === "extension" && {
+              ...(pack?.contributes ?? entry.contributes) && {
+                contributes: contributionSummary(pack?.contributes ?? entry.contributes)
+              },
+              ...(pack?.permissions ?? entry.permissions) && {
+                permissions: pack?.permissions ?? entry.permissions
+              },
+              ...(pack?.activates ?? entry.activates) && {
+                activates: pack?.activates ?? entry.activates
+              }
+            }
+          };
+        })
       ];
-      return json(args.installable_only ? entries.filter((e) => e.connections === 0) : entries);
+      const ofKind = args.kind ? entries.filter((e) => e.kind === args.kind) : entries;
+      return json(
+        args.installable_only ? ofKind.filter(
+          (e) => e.kind === "extension" ? !("installed" in e && e.installed) : e.connections === 0
+        ) : ofKind
+      );
     }
   );
   server.tool(
@@ -3889,7 +4275,7 @@ function registerConnectorTools(server) {
   );
   server.tool(
     "inspect_connector_package",
-    "Start a connector package and read what it offers \u2014 its triggers, actions and required environment variables \u2014 without installing it. Use this to review a connector before install_connector, or to check a local build.",
+    "Start a connector package and read what it offers \u2014 its triggers, actions and required environment variables, or for an extension what it contributes to a card and what it asks to touch \u2014 without installing it. Use this to review one before install_connector, or to check a local build.",
     {
       package: V.shortText.describe(
         'npm package name, or a command to run a local build (e.g. "node /path/to/dist/index.js")'
@@ -3903,10 +4289,10 @@ function registerConnectorTools(server) {
   );
   server.tool(
     "install_connector",
-    "Install a connector from a pack file, from the catalog, or from an npm package, creating a connection ready to poll. Call list_connectors for catalog ids and inspect_connector_package to see which environment variables are needed. Secrets cannot be set this way \u2014 see the error it returns if the connector requires one.",
+    "Install a connector from a pack file, from the catalog, or by a launch command, creating a connection ready to poll. Installing an extension is the whole of setting it up: it takes no trigger and makes no connection, and shows on the cards its activation names. Call list_connectors for catalog ids and inspect_connector_package to see which environment variables are needed. Secrets cannot be set this way \u2014 see the error it returns if the connector requires one.",
     {
       connector_id: V.id.optional().describe("Catalog connector id (from list_connectors). Use this or package."),
-      package: V.shortText.optional().describe("npm package name or launch command"),
+      package: V.shortText.optional().describe("Launch command the connection runs, or a package name to run with npx"),
       pack_path: V.shortText.optional().describe(
         "Path to a .vorn.tgz pack to install first. It is verified and copied to disk, and the connection then launches those files rather than resolving a package."
       ),
@@ -3932,6 +4318,38 @@ function registerConnectorTools(server) {
         });
         if (!outcome.ok) return failure(`The pack was refused: ${outcome.error}`);
         installed = outcome.pack;
+      } else if (entry?.kind === "extension") {
+        if (!entry.packUrl) {
+          return failure(
+            `${entry.name} is in the catalog but no release has published a pack for it yet.`
+          );
+        }
+        const outcome = await rpcCall("connector:installPack", {
+          kind: "url",
+          url: entry.packUrl,
+          ...entry.sha256 && { sha256: entry.sha256 }
+        });
+        if (!outcome.ok) return failure(`The pack was refused: ${outcome.error}`);
+        installed = outcome.pack;
+      }
+      if (installed?.kind === "extension") {
+        const ignored = [
+          args.trigger !== void 0 && "trigger",
+          args.sync_interval_minutes !== void 0 && "sync_interval_minutes",
+          args.env !== void 0 && "env",
+          args.name !== void 0 && "name",
+          args.project !== void 0 && "project"
+        ].filter(Boolean);
+        return json({
+          installed: installed.name,
+          kind: "extension",
+          version: installed.version,
+          path: installed.path,
+          contributes: installed.contributes ?? {},
+          permissions: installed.permissions ?? [],
+          ...installed.activates && { activates: installed.activates },
+          note: "Extensions have no connection: they show on the cards their activation names." + (ignored.length > 0 ? ` Ignored ${andList(ignored)}, which only a connection uses.` : "")
+        });
       }
       const target = installed ? packLaunch(installed) : entry?.launch ?? args.package;
       if (!target) return failure("Provide either connector_id, package, or pack_path.");
@@ -4330,6 +4748,7 @@ function registerDeviceTools(server) {
         sessionId: id,
         udid: args.udid
       });
+      if (!r.ok) throw new Error(r.message);
       return {
         content: [{ type: "text", text: `Claimed ${r.name} (${r.udid}).` }]
       };
@@ -4523,7 +4942,7 @@ console.warn = (...args) => _origError("[mcp:warn]", ...args);
 console.error = (...args) => _origError("[mcp:error]", ...args);
 async function main() {
   configManager.init();
-  const version = true ? "0.7.0-beta.9" : createRequire(import.meta.url)("../package.json").version;
+  const version = true ? "0.7.0" : createRequire(import.meta.url)("../package.json").version;
   const server = createMcpServer(version);
   const transport = new StdioServerTransport();
   await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vornrun/mcp",
-  "version": "0.7.0-beta.9",
+  "version": "0.7.0",
   "description": "Vorn MCP server — task management, git, and workflow tools for AI coding agents",
   "type": "module",
   "license": "MIT",
@@ -35,11 +35,11 @@
     "libsql": "^0.5.29",
     "pino": "^10.3.1",
     "ws": "^8.21.1",
-    "zod": "^4.4.3"
+    "zod": "^4.5.4"
   },
   "devDependencies": {
-    "@vornrun/server": "0.7.0-beta.9",
-    "@vornrun/shared": "0.7.0-beta.9",
+    "@vornrun/server": "0.7.0",
+    "@vornrun/shared": "0.7.0",
     "tsup": "^8.5.1",
     "tsx": "^4.23.1",
     "typescript": "^6.0.3"