@wenathlan/extension 1.1.53 → 1.1.55

package/extension/dist/background.js

@@ -2383,6 +2383,133 @@ var sessionmemory = class {
   async removeworkflowversion(id, version) {
     await this.adapter.set("workflowrecords", (await this.getworkflowrecordversions()).filter((entry) => !(entry.id === id && entry.version === version)));
   }
+  /** Returns every stored mcp client record, newest first. */
+  async getclients() {
+    return await this.adapter.get("mcpclients") ?? [];
+  }
+  /** Upserts one mcp client record by its id so one clientrecord stays per connected transport. */
+  async setclient(client) {
+    const records = (await this.getclients()).filter((entry) => entry.id !== client.id);
+    await this.adapter.set("mcpclients", [client, ...records]);
+  }
+  /** Returns the connected client records — every client whose disconnect time is absent. */
+  async listclients() {
+    return (await this.getclients()).filter((client) => client.disconnectedat === void 0);
+  }
+  /** Stores the negotiated capability set of one client on its record. */
+  async setclientcapabilities(id, capabilities) {
+    await this.adapter.set("mcpclients", (await this.getclients()).map((client) => client.id === id ? { ...client, capabilities } : client));
+  }
+  /** Drops every stored client record when the server stops. */
+  async clearclients() {
+    await this.adapter.set("mcpclients", []);
+  }
+  /** Records one stdio bridge launch event with its process id; a restart marker distinguishes the relaunch of a dead client process. */
+  async addbridgelaunch(launch) {
+    await this.adapter.set("mcbridgelaunches", [launch, ...await this.adapter.get("mcbridgelaunches") ?? []]);
+  }
+  /** Returns every stdio bridge launch event, newest first. */
+  async listbridgelaunches() {
+    return await this.adapter.get("mcbridgelaunches") ?? [];
+  }
+  /** Returns the user configured mcp server config; an absent record keeps the documented localhost default. */
+  async getmcpconfig() {
+    return this.adapter.get("mcpconfig");
+  }
+  /** Stores the user configured mcp server config: bind address, port, transports, frame size, queue depth and enablement all stay user choices. */
+  async setmcpconfig(config) {
+    return this.adapter.set("mcpconfig", config);
+  }
+  /** Returns the persisted mcp server runtime state. */
+  async getmcpstate() {
+    return this.adapter.get("mcpstate");
+  }
+  /** Stores the mcp server runtime state with the stdio bridge status. */
+  async setmcpstate(state) {
+    return this.adapter.set("mcpstate", state);
+  }
+  /** Records one mcp tool call — the client, the tool, the origin and the outcome without any payload — under the user configured call retention with no code ceiling. */
+  async addtoolcall(record2) {
+    const records = await this.listtoolcalls();
+    const retention = (await this.getmcpconfig())?.callretention;
+    await this.adapter.set("mcptoolcalls", retention === void 0 ? [record2, ...records] : [record2, ...records].slice(0, retention));
+  }
+  /** Returns every stored mcp tool call record, newest first. */
+  async listtoolcalls() {
+    return await this.adapter.get("mcptoolcalls") ?? [];
+  }
+  /** Returns every stored session token of paired remote clients; the records carry only their tokenhash form so raw tokens never persist. */
+  async getsessiontokens() {
+    return await this.adapter.get("mcpsessiontokens") ?? [];
+  }
+  /** Replaces the stored session token set after one issue, revocation or expiry sweep. */
+  async setsessiontokens(tokens) {
+    return this.adapter.set("mcpsessiontokens", tokens);
+  }
+  /** Returns every stored pairing code with its single use state, newest first. */
+  async getpairingcodes() {
+    return await this.adapter.get("mcppairingcodes") ?? [];
+  }
+  /** Records one issued pairing code for the one time client pairing. */
+  async addpairingcode(code) {
+    return this.adapter.set("mcppairingcodes", [code, ...(await this.getpairingcodes()).filter((candidate) => candidate.code !== code.code)]);
+  }
+  /** Marks one pairing code used so it never pairs a second client; an unknown code stays untouched. */
+  async usepairingcode(code, now) {
+    await this.adapter.set("mcppairingcodes", (await this.getpairingcodes()).map((candidate) => candidate.code === code ? { ...candidate, usedat: now } : candidate));
+  }
+  /** Returns every client allowlist entry with its grant history. */
+  async getallowlist() {
+    return await this.adapter.get("mcpallowlist") ?? [];
+  }
+  /** Upserts one client allowlist entry by its fingerprint with the grant history riding the record. */
+  async setallowlistentry(entry) {
+    await this.adapter.set("mcpallowlist", [entry, ...(await this.getallowlist()).filter((candidate) => candidate.fingerprint !== entry.fingerprint)]);
+  }
+  /** Removes one client allowlist entry so its fingerprint stops passing the allowlist check. */
+  async removeallowlistentry(fingerprint) {
+    await this.adapter.set("mcpallowlist", (await this.getallowlist()).filter((entry) => entry.fingerprint !== fingerprint));
+  }
+  /** Returns every approval gate with its decision state — the pending and resolved gates of the approval view. */
+  async listapprovals() {
+    return await this.adapter.get("mcpapprovals") ?? [];
+  }
+  /** Records one raised approval gate or its resolved state, keyed by the gate id. */
+  async setapproval(request) {
+    await this.adapter.set("mcpapprovals", [request, ...(await this.listapprovals()).filter((candidate) => candidate.id !== request.id)]);
+  }
+  /** Records one approval execution — the decision, the actor, the time and the latency — beside its gate. */
+  async addapprovalexec(exec) {
+    return this.adapter.set("mcpapprovalexecs", [exec, ...await this.adapter.get("mcpapprovalexecs") ?? []]);
+  }
+  /** Returns every approval execution record, newest first. */
+  async listapprovalexecs() {
+    return await this.adapter.get("mcpapprovalexecs") ?? [];
+  }
+  /** Records one auth handshake event with its issued, verified or refused outcome. */
+  async addauthhandshake(event) {
+    return this.adapter.set("mcpauthhandshakes", [event, ...await this.adapter.get("mcpauthhandshakes") ?? []]);
+  }
+  /** Returns every auth handshake event with its outcome, newest first. */
+  async listauthhandshakes() {
+    return await this.adapter.get("mcpauthhandshakes") ?? [];
+  }
+  /** Returns every stored client identity with its fingerprint for allowlist matching. */
+  async getclientidentities() {
+    return await this.adapter.get("mcpidentities") ?? [];
+  }
+  /** Upserts one client identity by its fingerprint so the allowlist matches it. */
+  async setclientidentity(identity) {
+    await this.adapter.set("mcpidentities", [identity, ...(await this.getclientidentities()).filter((candidate) => candidate.fingerprint !== identity.fingerprint)]);
+  }
+  /** Returns every open and closed stream channel of the http stream transport. */
+  async getstreamchannels() {
+    return await this.adapter.get("mcpchannels") ?? [];
+  }
+  /** Replaces the stored stream channel set after one open, heartbeat or close sweep. */
+  async setstreamchannels(channels) {
+    return this.adapter.set("mcpchannels", channels);
+  }
 };
 function mediakindof(record2) {
   if ("pages" in record2) return "pdf";
@@ -2426,6 +2553,97 @@ function randomid() {
   return crypto.randomUUID();
 }
 
+// toolcatalog.ts
+var toolcatalogversion = 1;
+var toolnamespaces = ["browser", "workflow", "memory", "system"];
+function toolschemaof(properties) {
+  return { type: "object", properties, required: Object.entries(properties).filter(([, property]) => property.required === true).map(([name]) => name) };
+}
+function readtool(name, kind, description, inputs = {}) {
+  return { name, version: toolcatalogversion, description, inputschema: toolschemaof({ target: { type: "string", description: "Reviewed css selector the tool addresses." }, value: { type: "string", description: "Reviewed literal value the tool carries." }, options: { type: "object", description: "Reviewed json options of the wrapped action kind with the empty default.", default: {} }, ...inputs }), kind, risk: "read" };
+}
+function gatedtool(name, kind, risk, description, review) {
+  return { name, version: toolcatalogversion, description, inputschema: toolschemaof({ stepid: { type: "string", description: "Id of the approved plan step this tool executes.", required: true } }), kind, risk, consentmeta: { review, riskclass: risk, approvalrequired: true, originscope: "session" } };
+}
+function browserdomain() {
+  return {
+    namespace: "browser",
+    version: toolcatalogversion,
+    tools: [
+      readtool("browser.snapshot", "observe", "Captures the semantic snapshot of the active tab: url, title, text preview, forms and interactive elements. Read only with no side effects; runs under the dryrun risk class once the session is approved."),
+      readtool("browser.extract", "extract", "Extracts the reviewed structured data of the page. Read only with no side effects."),
+      readtool("browser.readtext", "readtext", "Reads the text of the addressed element. Read only with no side effects.", { target: { type: "string", description: "Reviewed css selector of the element to read.", required: true } }),
+      readtool("browser.readtable", "readtable", "Reads the rows of the addressed data table. Read only with no side effects.", { target: { type: "string", description: "Reviewed css selector of the table to read.", required: true } }),
+      readtool("browser.readlinks", "readlinks", "Reads the link inventory of the page. Read only with no side effects."),
+      readtool("browser.a11ytree", "a11ytree", "Reads the accessibility tree of the page. Read only with no side effects."),
+      readtool("browser.tablist", "tablist", "Lists the open tabs. Read only with no side effects."),
+      readtool("browser.windowlist", "windowlist", "Lists the open windows. Read only with no side effects."),
+      gatedtool("browser.click", "click", "sensitive", "Clicks the addressed element. Sensitive: it changes page state, so it executes exactly one approved plan step.", "The click runs only as the approved plan step it names; a paired client can never widen the reviewed target or options."),
+      gatedtool("browser.type", "type", "sensitive", "Types the reviewed text into the addressed element. Sensitive: it changes page state, so it executes exactly one approved plan step.", "The typing runs only as the approved plan step it names; the reviewed target, text and options stay fixed."),
+      gatedtool("browser.presskey", "presskey", "sensitive", "Presses the reviewed key. Sensitive: it changes page state, so it executes exactly one approved plan step.", "The key press runs only as the approved plan step it names."),
+      gatedtool("browser.navigate", "navigate", "sensitive", "Navigates the active tab to the reviewed url. Sensitive: it changes browser state, so it executes exactly one approved plan step.", "The navigation runs only as the approved plan step it names and stays inside the session origin grants."),
+      gatedtool("browser.back", "back", "sensitive", "Navigates back in the history of the active tab. Sensitive: it changes browser state, so it executes exactly one approved plan step.", "The history navigation runs only as the approved plan step it names."),
+      gatedtool("browser.forward", "forward", "sensitive", "Navigates forward in the history of the active tab. Sensitive: it changes browser state, so it executes exactly one approved plan step.", "The history navigation runs only as the approved plan step it names."),
+      gatedtool("browser.reload", "reload", "sensitive", "Reloads the active tab. Sensitive: it changes browser state, so it executes exactly one approved plan step.", "The reload runs only as the approved plan step it names."),
+      gatedtool("browser.tabcreate", "tabcreate", "sensitive", "Opens a new tab. Sensitive: it changes browser state, so it executes exactly one approved plan step.", "The tab creation runs only as the approved plan step it names."),
+      gatedtool("browser.tabactivate", "tabactivate", "sensitive", "Activates the reviewed tab. Sensitive: it moves focus, so it executes exactly one approved plan step.", "The tab activation runs only as the approved plan step it names."),
+      gatedtool("browser.tabclose", "tabclose", "sensitive", "Closes the reviewed tab. Sensitive: it destroys browser state, so it executes exactly one approved plan step.", "The tab close runs only as the approved plan step it names."),
+      gatedtool("browser.windowcreate", "windowcreate", "sensitive", "Opens a new window. Sensitive: it changes browser state, so it executes exactly one approved plan step.", "The window creation runs only as the approved plan step it names."),
+      gatedtool("browser.windowclose", "windowclose", "sensitive", "Closes the reviewed window. Sensitive: it destroys browser state, so it executes exactly one approved plan step.", "The window close runs only as the approved plan step it names."),
+      gatedtool("browser.windowresize", "windowresize", "sensitive", "Resizes the reviewed window. Sensitive: it changes browser state, so it executes exactly one approved plan step.", "The window resize runs only as the approved plan step it names.")
+    ]
+  };
+}
+function workflowdomain() {
+  return {
+    namespace: "workflow",
+    version: toolcatalogversion,
+    tools: [
+      readtool("workflow.list", "composeworkflow", "Lists the composed workflows with their names, versions, origins and step counts. Read only with no side effects."),
+      readtool("workflow.dryrun", "dryrun", "Runs a composed workflow as a dry run: read steps project their would be outcome and every step with side effects is refused. Read only with no side effects."),
+      gatedtool("workflow.run", "runworkflow", "sensitive", "Runs a composed workflow for real. Sensitive: it executes every step of the workflow, so it executes exactly one approved runworkflow plan step with its explicit run review.", "The workflow run needs the explicit run review: the approved runworkflow plan step with its expanded step list shown before the first step executes."),
+      gatedtool("workflow.triggers", "eventrule", "sensitive", "Lists the armed trigger rules with their schedules, cooldowns and fire counters so a client can inspect what launches runs automatically. Sensitive by its trigger family: automatic launchers stay behind the arm review class.", "The trigger listing runs behind the approved plan review because trigger rules launch runs automatically.")
+    ]
+  };
+}
+function memorydomain() {
+  return {
+    namespace: "memory",
+    version: toolcatalogversion,
+    tools: [
+      readtool("memory.list", "listruns", "Lists the stored workflow run records with their states and step cursors from local memory. Read only with no page access.", { target: { type: "string", description: "Unused by the memory read; kept for schema uniformity." }, value: { type: "string", description: "Unused by the memory read; kept for schema uniformity." }, state: { type: "string", description: "Optional reviewed run state filter of the listing.", default: "" } }),
+      readtool("memory.variables", "extractvars", "Reads the stored variable scopes of a run from local memory. Read only with no page access."),
+      readtool("memory.audit", "trailaudit", "Reads the audit summary of the session trail from local memory. Read only with no page access.")
+    ]
+  };
+}
+function systemdomain() {
+  return {
+    namespace: "system",
+    version: toolcatalogversion,
+    tools: [
+      readtool("system.status", "observe", "Reports the mcp server status, the session state and the connected clients. Read only with no side effects."),
+      readtool("system.version", "readmeta", "Reports the protocol version, the catalog version and the extension version. Read only with no side effects."),
+      readtool("system.capabilities", "observe", "Reports the optional browser capabilities the user has granted. Read only with no side effects.")
+    ]
+  };
+}
+function buildtoolcatalog() {
+  return { version: toolcatalogversion, domains: [browserdomain(), workflowdomain(), memorydomain(), systemdomain()] };
+}
+function alltools(catalog) {
+  return catalog.domains.flatMap((domain) => domain.tools);
+}
+function resolvetool(catalog, name) {
+  if (name.includes(".")) return alltools(catalog).find((tool) => tool.name === name);
+  const matches = alltools(catalog).filter((tool) => tool.name.split(".")[1] === name);
+  return matches.length === 1 ? matches[0] : void 0;
+}
+function namespaceof(name) {
+  const head = name.split(".")[0];
+  return toolnamespaces.includes(head) ? head : void 0;
+}
+
 // socketbus.ts
 var socketkinds = ["opensocket", "sendmessage", "waitmessage", "subscribesse", "longpoll"];
 function channelorigin(url) {
@@ -5232,7 +5450,7 @@ function consolediff(input) {
 // policy.ts
 var sensitiveactions = /* @__PURE__ */ new Set(["click", "type", "navigate", "select", "presskey", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "reload", "back", "forward", "writestorage", "setattribute", "removeattribute", "evaluate", "tabcreate", "tabactivate", "tabclose", "tabreload", "windowcreate", "windowclose", "windowresize", "downloadfile", "clickpoint", "shiftclick", "dismissdialog", "enterframe", "typetime", "appendtext", "setvalue", "typeedit", "keyhold", "keyrelease", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "openlink", "openprivate", "reloadcache", "stopnav", "followlink", "spanav", "rewritequery", "setfragment", "navlist", "navprofile", "handleauth", "printpdf", "prefetch", "preconnect", "deeplink", "reopentab", "pausenav", "navrate", "openclipboard", "batchopen", "duplicatetab", "closepattern", "pintab", "mutetab", "movetab", "movetabwindow", "grouptabs", "colorgroup", "collapsegroup", "discardtab", "reloadtabs", "zoomin", "zoomout", "switchtab", "maximizewindow", "minimizewindow", "restorewindow", "focuswindow", "scratchwindow", "incognitowindow", "restoretab", "restorelayout", "reopenrun", "badgetab", "fillform", "filllabel", "fillplaceholder", "submitform", "retryform", "runwizard", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcard", "fillcode", "consentpassword", "exportcsv", "exportjson", "exportexcel", "copytable", "pushsheets", "streamdisk", "paginateextract", "resumeextract", "batchdownload", "pausedownload", "resumedownload", "interceptmime", "readclipboard", "writeclipboard", "copyscreen", "quarantinedownload", "scanvirus", "cleanupartifacts", "recordscreen", "captureaudio", "downloadimages", "callrest", "callgraphql", "sendmessage", "blockrequest", "mockresponse", "rewriteheaders", "setcookies", "clearcookies", "authflow", "saveapikey", "routeproxy", "postform", "postfiles", "attachcdp", "detachcdp", "cdpcmd", "overridescript", "heapshot", "profilecpu", "capturesourcemaps", "emulatedevice", "emulatenetwork", "emulatelocate", "setuseragent", "overridepermission", "restoresession", "exportsessions", "importsessions", "runworkflow", "visitrule", "urlrule", "menurule", "keyrule", "buttonrule", "cronrule", "intervalrule", "urllistrule", "webhookrule", "eventrule"]);
 var interactionactions = /* @__PURE__ */ new Set(["focus", "scroll", "hover", "clickdeep", "rightclick", "doubleclick", "scrollpage", "scrollby", "scrollend", "scrolltop", "fullscreen", "zoomset", "movepointer", "clicktext", "clickaria", "clickname", "expanddetails", "pierceshadow", "retryaction", "capturebodies", "setbreakpoint", "stepcode", "watchexpr", "loop", "repeatuntil", "whileloop", "foreach", "parallel", "trycatch"]);
-var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars", "condition", "branch"]);
+var readactions = /* @__PURE__ */ new Set(["observe", "inspect", "extract", "wait", "waitfor", "waittext", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "readlinks", "readimages", "readmeta", "readforms", "readstorage", "highlight", "tablist", "windowlist", "tabsnapshot", "mapclicks", "verifyvisible", "verifyenabled", "resolvexpath", "a11ytree", "readvisible", "readertree", "detectlists", "detecttables", "readjson", "watchmutate", "waitquiet", "watchbanner", "detectinfinitescroll", "detectvirtual", "detectlazy", "readscrollpos", "readlang", "readoutline", "countpages", "listshadow", "listframes", "classifypage", "fingerprintsection", "diffsnapshots", "readselection", "watchfocus", "detectsticky", "detectscrolllock", "readopengraph", "detectlanguage", "deriveselector", "waitload", "waiturl", "spawait", "detecthttp", "readredirects", "readfinalurl", "trailaudit", "navintent", "checksafe", "querytabs", "watchtab", "findclones", "searchtabs", "listaudio", "snapshotsession", "savelayout", "attachmeta", "detectfields", "generatevalues", "saveprofiles", "asksubmit", "readerrors", "skiphoneypot", "detectlogin", "detecttemplate", "handoffcaptcha", "scrapetable", "importcsv", "looprows", "transformvalues", "deduperows", "mergepages", "stamplerows", "previewgrid", "logprovenance", "verifydownload", "exportnetlog", "namecaptures", "shotview", "shotfullpage", "shotelement", "shotregion", "contactsheet", "capturepdf", "captureframe", "readmedia", "readassets", "probestream", "timelapse", "shotcanvas", "convertimage", "makethumbs", "fetchurl", "parsejson", "parsehtml", "opensocket", "waitmessage", "watchrequests", "readheaders", "mapapi", "subscribesse", "longpoll", "extractapi", "readcookies", "watchconsole", "watcherrors", "watchtasks", "watchcdp", "measureflow", "trackmemory", "watchshifts", "traceload", "annotatetrace", "replaytrace", "blackboxscripts", "persiststate", "capturesession", "namedsessions", "diffsessions", "searchsessions", "composeworkflow", "savetemplate", "dryrun", "delay", "waitelement", "compute", "extractvars", "listruns", "condition", "branch"]);
 var allowedactions = /* @__PURE__ */ new Set([...sensitiveactions, ...interactionactions, ...readactions]);
 var watchactions = /* @__PURE__ */ new Set(["watchmutate", "watchbanner", "watchfocus", "watchtab"]);
 var targetactions = /* @__PURE__ */ new Set(["inspect", "focus", "click", "type", "scroll", "select", "hover", "clickdeep", "rightclick", "doubleclick", "drag", "drop", "upload", "clear", "check", "uncheck", "toggle", "submit", "readattribute", "readstyle", "readgeometry", "readvalue", "readtext", "readhtml", "countelements", "readtable", "highlight", "setattribute", "removeattribute", "waitfor", "shiftclick", "typetime", "appendtext", "setvalue", "typeedit", "submitsearch", "selectmulti", "chooseradio", "setslider", "setdate", "setcolor", "expanddetails", "verifyvisible", "verifyenabled", "pierceshadow", "deriveselector", "fingerprintsection", "submitform", "retryform", "selectchain", "picktypeahead", "pickdate", "attachfile", "fillcode", "consentpassword", "scrapetable", "paginateextract", "shotelement", "captureframe", "shotcanvas"]);
@@ -8119,6 +8337,86 @@ function watchdogconfigvalid(config) {
   if (config.zombiewindow !== void 0 && (typeof config.zombiewindow !== "number" || !Number.isFinite(config.zombiewindow) || config.zombiewindow <= 0)) return { allowed: false, reason: "The watchdog zombie window, when configured, must be a positive number of milliseconds with no code ceiling." };
   return { allowed: true };
 }
+function serverbindgate(config) {
+  const bind = config.bind !== void 0 && config.bind.trim() !== "" ? config.bind.trim() : "127.0.0.1";
+  const local = bind === "127.0.0.1" || bind === "localhost" || bind === "::1";
+  if (!local && config.remote !== true) return { allowed: false, reason: `The bind ${bind} leaves localhost and grades sensitive: the explicit remote review must approve it first.` };
+  return { allowed: true };
+}
+function serverenablementgate(config) {
+  if (config.enabled !== true) return { allowed: false, reason: "The mcp server starts only after the user enables it; the protocol surface stays closed by default." };
+  const bind = serverbindgate(config);
+  if (!bind.allowed) return bind;
+  if (!Array.isArray(config.transports) || config.transports.length === 0) return { allowed: false, reason: "The mcp server needs at least one allowed transport of stdio or http." };
+  if (!config.transports.every((transport) => transport === "stdio" || transport === "http")) return { allowed: false, reason: "The allowed transports of the mcp server are stdio and http." };
+  if (typeof config.port !== "number" || !Number.isFinite(config.port) || config.port <= 0 || config.port > 65535) return { allowed: false, reason: "The http listener port must be a valid port number." };
+  if (config.framesize !== void 0 && (typeof config.framesize !== "number" || !Number.isFinite(config.framesize) || config.framesize <= 0)) return { allowed: false, reason: "The user configured frame size must stay a positive number with no code ceiling." };
+  if (config.queuedepth !== void 0 && (typeof config.queuedepth !== "number" || !Number.isFinite(config.queuedepth) || config.queuedepth <= 0)) return { allowed: false, reason: "The user configured queue depth must stay a positive number with no code ceiling." };
+  const remote = remoteenablementgate(config);
+  if (!remote.allowed) return remote;
+  return { allowed: true };
+}
+function tooldispatchgate(input) {
+  if (input.client.disconnectedat !== void 0) return { allowed: false, reason: "The mcp client is disconnected and its tool calls are refused." };
+  if (!input.client.paired) return { allowed: false, reason: "The mcp client waits for the user pairing approval; unpaired clients never dispatch tools." };
+  if (!input.session || input.session.stoppedat || input.session.pausedat) return { allowed: false, reason: "Tool dispatch needs the live browser session behind the consent gates." };
+  if (input.session.expiresat <= input.now) return { allowed: false, reason: "The browser session has expired and tool dispatch is refused." };
+  if (!input.plan || input.plan.state !== "approved") return { allowed: false, reason: "Tool dispatch needs the approved plan review before any tool runs." };
+  if (!origingranted(input.session, input.origin)) return { allowed: false, reason: `The tool call origin ${input.origin} stays outside the session grants and is refused.` };
+  if (input.tool.risk === "read") return { allowed: true };
+  if (input.stepid === void 0 || input.stepid.trim() === "") return { allowed: false, reason: `The ${input.tool.name} tool has side effects and needs the id of the approved plan step it executes.` };
+  const step = input.plan.steps.find((candidate) => candidate.id === input.stepid);
+  if (step === void 0) return { allowed: false, reason: `The tool call names the step ${input.stepid} which the approved plan does not carry.` };
+  if (step.kind !== input.tool.kind) return { allowed: false, reason: `The tool call names the step ${input.stepid} whose kind ${String(step.kind)} does not match the ${input.tool.name} tool.` };
+  return { allowed: true };
+}
+function allowlistentryvalid(entry, identities) {
+  if (typeof entry.fingerprint !== "string" || entry.fingerprint.trim() === "") return { allowed: false, reason: "The allowlist entry needs the client fingerprint it grants." };
+  if (!identities.some((identity) => identity.fingerprint === entry.fingerprint)) return { allowed: false, reason: `The allowlist entry ${entry.fingerprint} matches no known client identity.` };
+  if (typeof entry.displayname !== "string" || entry.displayname.trim() === "") return { allowed: false, reason: `The allowlist entry ${entry.fingerprint} needs its display name.` };
+  if (!Array.isArray(entry.namespaces) || entry.namespaces.length === 0) return { allowed: false, reason: `The allowlist entry ${entry.displayname} grants no tool namespace.` };
+  if (!entry.namespaces.every((namespace) => toolnamespaces.includes(namespace))) return { allowed: false, reason: `The allowlist entry ${entry.displayname} grants an unreviewed namespace.` };
+  return { allowed: true };
+}
+function tokenlifetimevalid(lifetime) {
+  if (lifetime === void 0) return { allowed: true };
+  if (typeof lifetime !== "number" || !Number.isFinite(lifetime) || lifetime <= 0) return { allowed: false, reason: "The token lifetime must stay a positive user value with no code ceiling." };
+  return { allowed: true };
+}
+function remotetransporttls(config) {
+  const bind = config.bind !== void 0 && config.bind.trim() !== "" ? config.bind.trim() : "127.0.0.1";
+  const local = bind === "127.0.0.1" || bind === "localhost" || bind === "::1";
+  const tls = config.remoteaccess?.tls ?? config.httpstream?.tls;
+  if ((config.remoteaccess !== void 0 || !local) && (tls === void 0 || tls.mode === "off")) return { allowed: false, reason: `The ${config.remoteaccess !== void 0 ? "remote transport" : `bind ${bind}`} leaves localhost and every non localhost transport requires tls before any remote traffic.` };
+  return { allowed: true };
+}
+function pairingreadinessgate(session, now) {
+  if (!session || session.stoppedat || session.pausedat) return { allowed: false, reason: "The pairing flow needs the live browser session before any code issues." };
+  if (session.expiresat <= now) return { allowed: false, reason: "The browser session has expired and the pairing flow is refused." };
+  return { allowed: true };
+}
+function remoteenablementgate(config) {
+  if (config.remoteaccess === void 0) return { allowed: true };
+  if (config.remote !== true) return { allowed: false, reason: "The remote transport enablement is a sensitive user choice and needs the explicit remote review." };
+  const tls = remotetransporttls(config);
+  if (!tls.allowed) return tls;
+  if (typeof config.remoteaccess.endpoint !== "string" || config.remoteaccess.endpoint.trim() === "") return { allowed: false, reason: "The remote access policy needs its user configured endpoint." };
+  if (config.remoteaccess.maxclients !== void 0 && (typeof config.remoteaccess.maxclients !== "number" || !Number.isFinite(config.remoteaccess.maxclients) || config.remoteaccess.maxclients <= 0)) return { allowed: false, reason: "The user configured client ceiling must stay a positive value with no code ceiling." };
+  const lifetime = tokenlifetimevalid(config.remoteaccess.tokenlifetimems);
+  if (!lifetime.allowed) return lifetime;
+  const timeout = approvaltimeoutvalid(config.remoteaccess.approvaltimeout);
+  if (!timeout.allowed) return timeout;
+  return { allowed: true };
+}
+function approvaltimeoutvalid(timeout) {
+  if (timeout === void 0) return { allowed: true };
+  if (typeof timeout.windowms !== "number" || !Number.isFinite(timeout.windowms) || timeout.windowms <= 0) return { allowed: false, reason: "The approval timeout must stay a positive user window with no code ceiling." };
+  if (timeout.ontimeout !== "refuse") return { allowed: false, reason: "The documented disposition of an unanswered approval gate is refusal." };
+  return { allowed: true };
+}
+function revocationgate() {
+  return { allowed: true };
+}
 
 // progress.ts
 function emptyprogress(planid, now) {
@@ -8291,13 +8589,298 @@ function recordtrigger(progress, planid, stepid, entry, now) {
   const outcome = { stepid, ok: true, summary: `${entry.detail}${counts.length > 0 ? ` with ${counts}` : ""}.`, details: { trigger: entry }, at: now };
   return recordoutcome(base, planid, outcome, now);
 }
+function recordtoolcall(progress, planid, stepid, entry, now) {
+  const base = progress && progress.planid === planid ? progress : emptyprogress(planid, now);
+  const outcome = { stepid, ok: entry.ok, summary: `The ${entry.tool} tool call of the client ${entry.clientid} ${entry.ok ? "ran behind the consent gates" : `was refused${entry.code !== void 0 ? ` with the ${entry.code} error` : ""}`}.`, details: { tool: entry }, at: now };
+  return recordoutcome(base, planid, outcome, now);
+}
 
 // version.ts
-var packageversion = "1.1.53";
+var packageversion = "1.1.55";
 
 // types.ts
 var protocolversion = packageversion;
 
+// clientauth.ts
+var tokenhashprefix = "sha256:";
+var defaulttokenlifetimems = 36e5;
+var defaultpairinglifetimems = 3e5;
+var defaultchallengelifetimems = 12e4;
+var authrefusedmessage = "The remote frame failed its authentication handshake.";
+async function tokenhashof(raw) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(raw));
+  return tokenhashprefix + [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function issuepairingcode(input) {
+  const scopes = input.scopes.filter((scope) => toolnamespaces.includes(scope));
+  return { code: input.code ?? `DT-${randomid().replace(/-/g, "").slice(0, 8).toUpperCase()}`, scopes, issuedat: input.now, expiresat: input.now + (input.lifetime ?? defaultpairinglifetimems) };
+}
+function redeempairingcode(input) {
+  const match = input.codes.find((candidate) => candidate.code === input.code);
+  if (match === void 0) return { reason: authrefusedmessage };
+  if (match.usedat !== void 0) return { reason: "The pairing code was already used once and never pairs a second client." };
+  if (input.now >= match.expiresat) return { reason: "The pairing code expired before the exchange completed." };
+  return { code: { ...match, usedat: input.now } };
+}
+async function issuetoken(input) {
+  const raw = input.raw ?? `${randomid()}.${randomid()}`;
+  const token = { id: input.id ?? randomid(), clientid: input.clientid, hash: await tokenhashof(raw), scopes: input.scopes.filter((scope) => toolnamespaces.includes(scope)), issuedat: input.now, expiresat: input.now + (input.lifetime ?? defaulttokenlifetimems) };
+  return { token, raw };
+}
+async function verifytoken(input) {
+  const hash = await tokenhashof(input.raw);
+  const match = input.tokens.find((candidate) => candidate.hash === hash);
+  if (match === void 0) return { reason: authrefusedmessage };
+  if (match.revokedat !== void 0) return { reason: authrefusedmessage };
+  if (input.now >= match.expiresat) return { reason: authrefusedmessage };
+  return { token: match };
+}
+function revokeclient(tokens, clientid, now) {
+  return tokens.map((token) => token.clientid === clientid && token.revokedat === void 0 ? { ...token, revokedat: now } : token);
+}
+function checkallowlist(input) {
+  const entry = input.entries.find((candidate) => candidate.fingerprint === input.fingerprint);
+  if (entry === void 0) return { allowed: false, reason: `The client fingerprint ${input.fingerprint} is not on the allowlist and is refused.` };
+  if (input.namespace !== void 0 && !entry.namespaces.includes(input.namespace)) return { allowed: false, reason: `The allowlist entry ${entry.displayname} grants no ${input.namespace} tools.` };
+  return { allowed: true };
+}
+function grantallowlistentry(input) {
+  const scopes = input.namespaces.filter((scope) => toolnamespaces.includes(scope));
+  const existing = input.entries.find((entry) => entry.fingerprint === input.identity.fingerprint);
+  if (existing === void 0) {
+    return [{ fingerprint: input.identity.fingerprint, displayname: input.identity.displayname, namespaces: scopes, grantedat: input.now, history: [{ at: input.now, actor: input.actor, change: `Granted the ${scopes.length > 0 ? scopes.join(", ") : "no"} namespaces.` }] }, ...input.entries];
+  }
+  return input.entries.map((entry) => entry.fingerprint !== input.identity.fingerprint ? entry : { ...entry, displayname: input.identity.displayname, namespaces: scopes, history: [{ at: input.now, actor: input.actor, change: `Rescoped to ${scopes.length > 0 ? scopes.join(", ") : "no"} namespaces.` }, ...entry.history] });
+}
+function issuechallenge(input) {
+  return { nonce: input.nonce ?? randomid(), method: input.method, issuedat: input.now, expiresat: input.now + (input.lifetime ?? defaultchallengelifetimems) };
+}
+function scopecheck(token, namespace) {
+  if (namespace === void 0) return { allowed: false, fast: true, reason: "The tool call names no reviewed namespace." };
+  if (token === void 0) return { allowed: false, reason: "The tool call carries no verified session token." };
+  if (!token.scopes.includes(namespace)) return { allowed: false, reason: `The session token grants no ${namespace} tools.` };
+  return { allowed: true };
+}
+function tlsstateof(tls) {
+  return { mode: tls.mode, certificaterequired: tls.mode === "required" || tls.certificatefingerprint !== void 0, verified: tls.verifiedat !== void 0 };
+}
+
+// mcpserver.ts
+var localhostbind = "127.0.0.1";
+var defaultmcpport = 7436;
+function rpcerrorof(code, message, data) {
+  return { code, message, ...data !== void 0 ? { data } : {} };
+}
+function defaultmcpconfig() {
+  return { port: defaultmcpport, transports: ["stdio", "http"], enabled: false };
+}
+function unwraphttppost(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const candidate = value;
+    if (candidate.transport === "http" && candidate.frame && typeof candidate.frame === "object" && !Array.isArray(candidate.frame)) return candidate.frame;
+  }
+  return value;
+}
+function parseframe(raw) {
+  const parsed = unwraphttppost(JSON.parse(raw));
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("A json rpc frame must be an object.");
+  return parsed;
+}
+function serializeframe(frame) {
+  return JSON.stringify(frame);
+}
+function validateframe(frame, methods, config) {
+  if (frame.jsonrpc !== "2.0") return rpcerrorof("parse", "The frame must carry the jsonrpc 2.0 tag.");
+  if (frame.id !== void 0 && typeof frame.id !== "number" && typeof frame.id !== "string" && frame.id !== null) return rpcerrorof("parse", "The frame id must be a number, a string or null.");
+  if (frame.method === void 0 || frame.method.trim() === "") return rpcerrorof("method", "The frame carries no method to route.");
+  if (!methods.some((entry) => entry.method === frame.method)) return rpcerrorof("method", `The server routes no method named ${frame.method}.`);
+  if (frame.params !== void 0 && (typeof frame.params !== "object" || Array.isArray(frame.params))) return rpcerrorof("params", "The frame params must be an object.");
+  if (config?.framesize !== void 0 && serializeframe(frame).length > config.framesize) return rpcerrorof("params", `The serialized frame exceeds the user configured frame size of ${config.framesize} characters.`);
+  return void 0;
+}
+function respond(input) {
+  return { jsonrpc: "2.0", ...input.id === void 0 ? input.error !== void 0 ? { id: null } : {} : { id: input.id }, ...input.error !== void 0 ? { error: input.error } : { result: input.result } };
+}
+function servermethods() {
+  return [
+    { method: "initialize", handler: "initialize", description: "Completes the mcp handshake and returns the server info." },
+    { method: "ping", handler: "ping", description: "Answers keepalive frames with pong." },
+    { method: "tools/list", handler: "listtools", description: "Returns every tool with its version and json schema inputs." },
+    { method: "negotiate", handler: "negotiate", description: "Exchanges capability sets with the client." },
+    { method: "tools/call", handler: "dispatch", description: "Invokes one tool behind the consent gates." }
+  ];
+}
+function servercapabilities(input) {
+  return { protocolversion, name: "devthink", version: protocolversion, toolversion: input.catalog.version, tools: alltools(input.catalog).length, namespaces: toolnamespaces, transports: input.config.transports };
+}
+function initialize(input) {
+  void input.params;
+  return { serverinfo: servercapabilities({ config: input.config, catalog: input.catalog }), protocolversion, instructions: "Devthink serves browser tools behind the human review gates: read only tools run once a session is approved while every tool with side effects executes exactly the approved plan step it names. No endpoint, provider or key is hardcoded; the user pairs every client." };
+}
+function ping(input) {
+  return { pong: true, at: input.now };
+}
+function listtools(catalog) {
+  return { tools: alltools(catalog).map((tool) => ({ name: tool.name, version: tool.version, description: tool.description, inputschema: tool.inputschema, risk: tool.risk, ...tool.consentmeta !== void 0 ? { consentmeta: { review: tool.consentmeta.review, riskclass: tool.consentmeta.riskclass ?? tool.risk, approvalrequired: tool.consentmeta.approvalrequired ?? true, originscope: tool.consentmeta.originscope ?? "session" } } : {} })) };
+}
+function negotiate(input) {
+  const client = input.client;
+  if (client?.protocolversion !== void 0 && client.protocolversion !== input.server.protocolversion) return { agreed: false, mismatch: `The client speaks protocol version ${String(client.protocolversion)} while the server offers ${input.server.protocolversion}.` };
+  if (client?.toolversion !== void 0 && client.toolversion > input.server.toolversion) return { agreed: false, mismatch: `The client requires tool version ${String(client.toolversion)} while the server offers ${String(input.server.toolversion)}.` };
+  if (client?.transports !== void 0 && client.transports.some((transport) => !input.server.transports.includes(transport))) return { agreed: false, mismatch: "The client requires a transport the server configuration does not allow." };
+  return { agreed: true, capabilities: input.server };
+}
+function connectclient(input) {
+  return { id: input.id ?? `client-${input.now}`, transport: input.transport, paired: false, connectedat: input.now };
+}
+function disconnectclient(clients, id, now) {
+  return clients.map((client) => client.id === id && client.disconnectedat === void 0 ? { ...client, disconnectedat: now } : client);
+}
+function negotiatetoolfloor(clientfloor, catalogversion) {
+  if (clientfloor === void 0) return { floor: catalogversion };
+  if (clientfloor > catalogversion) return { mismatch: `The client requires the tool version floor ${clientfloor} while the catalog serves version ${catalogversion}.` };
+  return { floor: clientfloor };
+}
+async function dispatchtool(input) {
+  const params = input.params;
+  if (!params || typeof params !== "object" || Array.isArray(params)) return { error: rpcerrorof("params", "The tool call needs its params object.") };
+  if (typeof params.name !== "string" || !params.name.trim()) return { error: rpcerrorof("params", "The tool call needs the namespaced name of the tool it invokes.") };
+  const tool = resolvetool(input.catalog, params.name.trim());
+  if (tool === void 0) return { error: rpcerrorof("params", `The catalog holds no unambiguous tool named ${params.name.trim()}.`) };
+  const namespace = namespaceof(tool.name);
+  if (namespace === void 0) return { error: rpcerrorof("params", `The tool ${tool.name} carries no reviewed namespace.`) };
+  if (input.scopes !== void 0 && !input.scopes.includes(namespace)) return { error: rpcerrorof("consentrefused", `The session token grants no ${namespace} tools.`) };
+  const floor = input.client.toolfloor ?? input.client.capabilities?.toolversion ?? input.catalog.version;
+  if (tool.version < floor) return { error: rpcerrorof("params", `The tool ${tool.name} of version ${tool.version} stays below the negotiated compatibility floor of ${floor}.`) };
+  const stepid = typeof params.stepid === "string" ? params.stepid : void 0;
+  const gate = tooldispatchgate({ client: input.client, tool, session: input.session, plan: input.plan, origin: input.origin, ...stepid !== void 0 ? { stepid } : {}, now: input.now });
+  if (!gate.allowed) return { error: rpcerrorof("consentrefused", gate.reason ?? "The consent gates refused the tool call.") };
+  const step = tool.risk === "read" ? { id: `mcp-${input.client.id}-${input.now}`, kind: tool.kind, summary: tool.description.split(".")[0] ?? tool.description, risk: "read", ...typeof params.target === "string" ? { target: params.target } : {}, ...typeof params.value === "string" ? { value: params.value } : {}, ...params.options !== void 0 && typeof params.options === "object" && !Array.isArray(params.options) ? { options: JSON.stringify(params.options) } : {} } : input.plan?.steps.find((candidate) => candidate.id === stepid);
+  if (step === void 0) return { error: rpcerrorof("consentrefused", "The tool call names a step the approved plan does not carry.") };
+  try {
+    const result = await input.execute(step);
+    return { result, step };
+  } catch (error) {
+    return { error: rpcerrorof("internal", error instanceof Error ? error.message : String(error)) };
+  }
+}
+async function handleframe(input) {
+  if (input.raw !== void 0 && input.config.framesize !== void 0 && input.raw.length > input.config.framesize) return respond({ id: null, error: rpcerrorof("params", `The wire frame exceeds the user configured frame size of ${input.config.framesize} characters.`) });
+  let frame;
+  if (input.raw !== void 0) {
+    try {
+      frame = parseframe(input.raw);
+    } catch {
+      return respond({ id: null, error: rpcerrorof("parse", "The wire frame does not parse as json.") });
+    }
+  } else if (input.frame !== void 0) {
+    frame = input.frame;
+  } else {
+    return respond({ id: null, error: rpcerrorof("parse", "The server received no frame to route.") });
+  }
+  const invalid = validateframe(frame, servermethods(), input.config);
+  if (invalid !== void 0) return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, error: invalid });
+  const entry = servermethods().find((candidate) => candidate.method === frame.method);
+  if (entry === void 0) return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, error: rpcerrorof("method", `The server routes no method named ${String(frame.method)}.`) });
+  const params = frame.params;
+  if (entry.handler === "initialize") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: initialize({ ...params !== void 0 ? { params } : {}, config: input.config, catalog: input.catalog }) });
+  if (entry.handler === "ping") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: ping({ now: input.now }) });
+  if (entry.handler === "listtools") return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, result: listtools(input.catalog) });
+  if (entry.handler === "negotiate") {
+    const server = servercapabilities({ config: input.config, catalog: input.catalog });
+    const clientcaps = params?.capabilities && typeof params.capabilities === "object" && !Array.isArray(params.capabilities) ? params.capabilities : void 0;
+    const outcome = negotiate({ ...clientcaps !== void 0 ? { client: clientcaps } : {}, server });
+    return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, ...outcome.agreed ? { result: outcome.capabilities } : { error: rpcerrorof("params", outcome.mismatch ?? "The capability negotiation did not agree.") } });
+  }
+  const dispatched = await dispatchtool({ ...params !== void 0 ? { params } : {}, client: input.client, catalog: input.catalog, ...input.session !== void 0 ? { session: input.session } : {}, ...input.plan !== void 0 ? { plan: input.plan } : {}, ...input.scopes !== void 0 ? { scopes: input.scopes } : {}, origin: input.origin, now: input.now, execute: input.execute });
+  return respond({ ...frame.id !== void 0 ? { id: frame.id } : {}, ...dispatched.error !== void 0 ? { error: dispatched.error } : { result: dispatched.result } });
+}
+function bindlocalhost(config) {
+  const bind = config.bind !== void 0 && config.bind.trim() !== "" ? config.bind.trim() : localhostbind;
+  return { bind, port: config.port, localhost: bind === localhostbind || bind === "localhost" || bind === "::1" };
+}
+function launchbridge(input) {
+  return { id: input.id ?? `bridge-${input.now}`, host: input.host, connected: true, ...input.pid !== void 0 ? { pid: input.pid } : {}, startedat: input.now, restarts: 0, received: 0, sent: 0 };
+}
+function relayframe(input) {
+  return { ...input.bridge, connected: true, received: input.bridge.received + (input.direction === "inbound" ? 1 : 0), sent: input.bridge.sent + (input.direction === "outbound" ? 1 : 0), lastframeat: input.now };
+}
+function toolcallevent(input) {
+  return { id: input.id, clientid: input.clientid, tool: input.tool, origin: input.origin, ok: input.ok, ...input.code !== void 0 ? { code: input.code } : {}, at: input.now };
+}
+
+// httpstream.ts
+var defaultheartbeatms = 3e4;
+var defaultidlewindowms = 9e4;
+function defaulthttpstream() {
+  return { endpoint: "/mcp", streampath: "/mcp/stream", tls: { mode: "off" }, heartbeatms: defaultheartbeatms, idlewindowms: defaultidlewindowms };
+}
+function openstreamchannel(input) {
+  return { id: input.id ?? `channel-${randomchannelid()}`, clientid: input.clientid, openedat: input.now, lastbeatat: input.now };
+}
+function randomchannelid() {
+  return crypto.randomUUID();
+}
+function heartbeat(input) {
+  return input.channels.map((channel) => channel.clientid === input.clientid && channel.closedat === void 0 ? { ...channel, lastbeatat: input.now } : channel);
+}
+function channellive(channel, now, idlewindow) {
+  if (channel.closedat !== void 0) return false;
+  return now - channel.lastbeatat < (idlewindow ?? defaultidlewindowms);
+}
+function closeidlechannels(input) {
+  return input.channels.map((channel) => channel.closedat === void 0 && !channellive(channel, input.now, input.idlewindow) ? { ...channel, closedat: input.now } : channel);
+}
+function starttls(input) {
+  if (input.config.mode === "off") return { tls: false, verified: false };
+  if (input.config.mode === "required" && input.presented?.fingerprint === void 0) return { tls: false, verified: false, reason: "The remote transport requires tls and the peer presented no certificate." };
+  if (input.config.certificatefingerprint !== void 0 && input.presented?.fingerprint !== input.config.certificatefingerprint) return { tls: false, verified: false, reason: "The peer certificate does not match the user configured fingerprint and the remote traffic is refused." };
+  return { tls: true, verified: true };
+}
+function enforcemaxclients(input) {
+  if (input.maxclients === void 0) return { allowed: true };
+  const connected = input.clients.filter((client) => client.disconnectedat === void 0).length;
+  if (connected >= input.maxclients) return { allowed: false, reason: `The user configured maximum of ${input.maxclients} remote clients is reached and the connection is refused.` };
+  return { allowed: true };
+}
+function listremotestatus(input) {
+  const stream = input.config.httpstream ?? defaulthttpstream();
+  const remote = input.config.remoteaccess;
+  const idlewindow = stream.idlewindowms;
+  const open = input.channels.filter((channel) => channellive(channel, input.now, idlewindow));
+  return { endpoint: remote?.endpoint ?? stream.endpoint, tls: tlsstateof(remote?.tls ?? stream.tls), clients: input.clients.filter((client) => client.disconnectedat === void 0).length, paired: input.clients.filter((client) => client.paired && client.disconnectedat === void 0).length, channelsopen: open.length, channelsdead: input.channels.length - open.length, tokenslive: input.tokens.filter((token) => token.revokedat === void 0 && input.now < token.expiresat).length };
+}
+async function httpframepipeline(input) {
+  const stream = input.config.httpstream ?? defaulthttpstream();
+  const tls = starttls({ config: input.config.remoteaccess?.tls ?? stream.tls, ...input.presented !== void 0 ? { presented: input.presented } : {}, now: input.now });
+  if (tls.reason !== void 0) return { error: rpcerrorof("consentrefused", tls.reason) };
+  if (input.rawtoken === void 0) return { error: rpcerrorof("consentrefused", authrefusedmessage) };
+  const verified = await verifytoken({ tokens: input.tokens, raw: input.rawtoken, now: input.now });
+  if (verified.token === void 0) return { error: rpcerrorof("consentrefused", verified.reason ?? authrefusedmessage) };
+  const namespace = input.toolname !== void 0 ? namespaceof(input.toolname) : void 0;
+  const listed = checkallowlist({ entries: input.allowlist, fingerprint: input.fingerprint, ...namespace !== void 0 ? { namespace } : {} });
+  if (!listed.allowed) return { error: rpcerrorof("consentrefused", listed.reason ?? "The allowlist refused the client.") };
+  const scoped = scopecheck(verified.token, namespace);
+  if (!scoped.allowed) return { error: rpcerrorof(scoped.fast === true ? "params" : "consentrefused", scoped.reason ?? "The tool call stayed outside the granted scopes.") };
+  return { token: verified.token };
+}
+
+// approvalgate.ts
+var defaultapprovalwindowms = 12e4;
+function requireapproval(input) {
+  return { id: input.id ?? randomid(), clientid: input.clientid, tool: input.tool, reason: input.reason, params: input.params, ...input.secretfields !== void 0 && input.secretfields.length > 0 ? { secretfields: input.secretfields } : {}, state: "pending", raisedat: input.now, ...input.timeout !== void 0 ? { timeoutat: input.now + input.timeout } : {} };
+}
+function resolveapproval(input) {
+  const gate = input.requests.find((request) => request.id === input.id);
+  if (gate === void 0 || gate.state !== "pending") return { requests: input.requests };
+  const decision = input.decision;
+  const requests = input.requests.map((request) => request.id === input.id ? { ...request, state: decision, decidedat: input.now, actor: input.actor } : request);
+  return { requests, exec: { requestid: input.id, decision, actor: input.actor, at: input.now, latencyms: input.now - gate.raisedat } };
+}
+function expireapprovals(requests, now) {
+  return requests.map((request) => request.state === "pending" && request.timeoutat !== void 0 && now >= request.timeoutat ? { ...request, state: "expired" } : request);
+}
+
 // protocol.ts
 function record(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Protocol message must be an object.");
@@ -8630,7 +9213,7 @@ function requestbody(input) {
   return JSON.stringify({ version: protocolversion, objective: input.objective, session: input.session, observation: input.observation, capabilities: input.capabilities });
 }
 function outcomeresponse(input) {
-  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed, ...input.workflow.timeout !== void 0 ? { timeout: input.workflow.timeout } : {}, ...input.workflow.retry !== void 0 ? { retry: input.workflow.retry } : {} } } : {}, ...input.trigger ? { trigger: { ruleid: input.trigger.ruleid, kind: input.trigger.kind, enabled: input.trigger.enabled, ...input.trigger.nextfireat !== void 0 ? { nextfireat: input.trigger.nextfireat } : {} } } : {} });
+  return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, outcome: input.outcome, ...input.resolvedtarget ? { resolvedtarget: input.resolvedtarget } : {}, ...input.capture ? { capture: input.capture } : {}, ...input.media ? { media: input.media } : {}, ...input.transport ? { transport: input.transport } : {}, ...input.network ? { network: input.network } : {}, ...input.control ? { control: input.control } : {}, ...input.timeline ? { timeline: input.timeline } : {}, ...input.cdp ? { cdp: input.cdp } : {}, ...input.profile ? { profile: input.profile } : {}, ...input.emulation ? { emulation: input.emulation } : {}, ...input.session ? { session: input.session } : {}, ...input.workflow ? { workflow: { runid: input.workflow.runid, state: input.workflow.state, ...input.workflow.dryrun === true ? { dryrun: true } : {}, produced: input.workflow.produced, consumed: input.workflow.consumed, ...input.workflow.timeout !== void 0 ? { timeout: input.workflow.timeout } : {}, ...input.workflow.retry !== void 0 ? { retry: input.workflow.retry } : {} } } : {}, ...input.trigger ? { trigger: { ruleid: input.trigger.ruleid, kind: input.trigger.kind, enabled: input.trigger.enabled, ...input.trigger.nextfireat !== void 0 ? { nextfireat: input.trigger.nextfireat } : {} } } : {}, ...input.tool ? { tool: { clientid: input.tool.clientid, tool: input.tool.tool, origin: input.tool.origin, ok: input.tool.ok, ...input.tool.code !== void 0 ? { code: input.tool.code } : {} } } : {} });
 }
 function mapresponse(input) {
   return JSON.stringify({ version: protocolversion, planid: input.plan.id, planstate: input.plan.state, map: input.map });
@@ -16083,6 +16666,8 @@ async function executeaction(step, session, plan, tabid2, origin, settings, verd
     } else if (istriggeraction(step.kind)) {
       if (!session || !plan || plan.state !== "approved") throw new Error("Trigger kinds refuse to run outside an approved session plan.");
       output = await executetriggerstep(step, session, plan, tabid2, origin);
+    } else if (step.kind === "listruns") {
+      output = await executelistruns(step, session);
     } else {
       if (step.target && freshcheckkinds.has(step.kind)) {
         const fresh = await snapshot(tabid2);
@@ -16337,7 +16922,7 @@ async function handlerequest(message, sender) {
       const livetab = session ? await chrome.tabs.get(session.tabid).catch(() => void 0) : void 0;
       const waitprofile = session ? waitprofiles.find((record2) => record2.origin === session.origin) : void 0;
       const livestate = { phase: livetab?.status === "loading" ? "loading" : "complete", ...navrecords[0] ? { finalurl: navrecords[0].finalurl, redirects: navrecords[0].chain } : {} };
-      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, trigger: triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() }), triggerretention: runsettings?.triggerretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id), control: await memory.listcontroldecisions(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, runhistoryretention: runsettings?.runhistoryretention, editor: editorstate({ versions: await memory.listworkflowversions(), diffs: await memory.listversiondiffs(), history: await memory.gethistory(), overrides: await memory.listsiteoverrides(), imports: (await memory.listworkflowimports()).map((entry) => ({ id: entry.id, workflowid: entry.record.id, name: entry.record.name, version: entry.record.version, steps: entry.record.steps.length, risk: entry.record.risk, importedat: entry.importedat, ...entry.filename !== void 0 ? { filename: entry.filename } : {} })), backgroundruns: await memory.getbackgroundruns(), watchdog: { ...runsettings?.watchdog !== void 0 ? { config: runsettings.watchdog } : {}, events: await memory.listwatchdogevents() } }), ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {} };
+      return { config: await memory.getconfig(), session, plan, progress: plan && progress?.planid === plan.id ? progress : void 0, diagnostic: await memory.getdiagnostic(), audit: await memory.getaudit(), capabilities: await refreshcapabilities(), outcomes: await memory.getoutcomes(), holds: heldkeysreport({ tabid: session?.tabid ?? 0, holds }), dialogs: await memory.getdialogs(), retries: await memory.getretries(), ...signals ? { signals: signalsreport({ signals }) } : { signals: signalsreport({}) }, banners: await memory.getbanners(), mutationevents: await memory.getmutationevents(), focusevents: await memory.getfocusevents(), diffs: await memory.getdiffs(), selectors: await memory.getselectors(), ...a11y ? { a11y } : {}, ...reader ? { reader } : {}, ...map ? { map } : {}, trail: trailreport({ ...session ? { sessionid: session.id } : {}, trail }), navrecords, ratestates, safeties, curated, waitprofiles, auths, navcontrol, navqueues, artifacts, navstate: livestate, ...waitprofile ? { waitprofile } : {}, offline: !navigator.onLine, tabs, windows, layouts: layoutreport({ layouts }), tabgroups, tabmetas, badges, snapshots, closedtabs, tabwatchevents, clones, tasktabgauge: taskgauge, ...controltab ? { controltab } : {}, tabreport: report, profiles, tickets, wizards: wizardreport({ ...session ? { sessionid: session.id } : {}, wizards, picks }), picks, errorreports, captchas, detections, ...codeentry !== void 0 ? { codeentry: true } : {}, datasets, imports, extractsessions, streams, exports, provenances, taskrules, sheetendpoints: sheetgrants, downloads, netlogs, clipconsents, clips, quarantines, cleanuprules, cleanupruns, capturecounters, inventory, mimefilters, scanhooks, captures: capturemetadata, capturepairs, capturepolicy: runsettings?.capturepolicy ?? "manual", media: mediarecords, imagebatches, recordingconsents, recordingactive: [...activerecordings.values()].map((active) => ({ id: active.record.id, kind: active.record.kind, scope: active.record.scope, startedat: active.record.startedat, stopat: active.stopat })), recordingwindow: runsettings?.recordingwindow, calls, endpoints, fetchconsents, apikeys, callretention: runsettings?.callretention, fetchesactive: activefetches.size, exchanges, channels, subscriptions, apimap, messages: messagecount, webrequestgrant: runsettings?.webrequestgrant === true, bodyretention: runsettings?.bodyretention, timelineretention: runsettings?.timelineretention, timeline, consoleconsents: await memory.getconsoleconsents(), rotationtargets: await memory.getrotationtargets(), levelsummaries: await memory.getlevelsummaries(), cdpsessions: await memory.getcdpsessions(), cdpcommands: await memory.getcdpcommands(), cdpeventrules: await memory.getcdpeventrules(), breakpoints: await memory.getbreakpoints(), pauses: await memory.getpauses(), watchexpressions: await memory.getwatchexpressions(), scriptoverrides: await memory.getscriptoverrides(), debuggergrants: await memory.getdebuggergrants(), pauseretention: runsettings?.pauseretention, breakpointceiling: runsettings?.breakpointceiling, cdpattached: [...activecdpsessions.values()].filter((active) => active.session.detachedat === void 0).length, profileretention: runsettings?.profileretention, traceceiling: runsettings?.traceceiling, profile: profilereport({ flows: await memory.getflowmetrics(), heaps: await memory.getheaprecords(), samples: await memory.getgrowsamples(), trends: await memory.gettrends(), profiles: await memory.getcpuprofiles(), shifts: await memory.getshiftentries(), traces: await memory.gettracerecords(), sourcemaps: await memory.getsourcemaps(), consents: await memory.getsourcemapconsents() }), profileactive: activememorytrackers.size + activeprofiletargets.size, profiletargets: [...activeprofiletargets.values()].flatMap((entry) => entry.targets), socketsactive: activesockets.size, emulation: emulationreport({ ...plan && await loademulationstate(plan.id) !== void 0 ? { state: await loademulationstate(plan.id) } : {}, devices: await memory.getdevicepresets(), networks: await memory.getnetworkpresets(), locations: await memory.getlocationpresets(), agents: await memory.getagentpresets(), blackbox: await memory.getblackboxrules(), permissions: await memory.getpermissionoverrides(), consents: await memory.getlocationconsents() }), emulatedlayers: plan ? layernames(await loademulationstate(plan.id)) : [], emulationretention: runsettings?.emulationretention, traffic, tokens, authflows, activerules: [...activerules.values()].reduce((total, ruleset) => total + ruleset.blocks.filter((rule) => rule.revertedat === void 0).length + ruleset.mocks.filter((rule) => rule.revertedat === void 0).length + ruleset.rewrites.filter((rule) => rule.revertedat === void 0).length + (ruleset.proxy !== void 0 && ruleset.proxy.revertedat === void 0 ? 1 : 0), 0), sessionmemory: sessionreport({ records: sessionrecords, events: await memory.getsessionevents(), folders: await memory.getsessionfolders(), diffs: await memory.getsessiondiffs(), ...autosnapshot !== void 0 ? { auto: autosnapshot.interval } : {}, ...crashed ? { crashed: true } : {} }), autosnapshotstate: autosnapshot, sessionretention: runsettings?.sessionretention, trigger: triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() }), triggerretention: runsettings?.triggerretention, workflow: workflowreport({ workflows: await memory.listworkflows(), runs: await memory.listworkflowruns(), templates: await memory.getsteptemplates(), ...newestworkflowrun !== void 0 ? { log: await memory.getrunlog(newestworkflowrun.id), scopes: await memory.getrunscopes(newestworkflowrun.id), provenance: await memory.getworkflowprovenance(newestworkflowrun.id), control: await memory.listcontroldecisions(newestworkflowrun.id) } : {} }), runlogretention: runsettings?.runlogretention, runhistoryretention: runsettings?.runhistoryretention, editor: editorstate({ versions: await memory.listworkflowversions(), diffs: await memory.listversiondiffs(), history: await memory.gethistory(), overrides: await memory.listsiteoverrides(), imports: (await memory.listworkflowimports()).map((entry) => ({ id: entry.id, workflowid: entry.record.id, name: entry.record.name, version: entry.record.version, steps: entry.record.steps.length, risk: entry.record.risk, importedat: entry.importedat, ...entry.filename !== void 0 ? { filename: entry.filename } : {} })), backgroundruns: await memory.getbackgroundruns(), watchdog: { ...runsettings?.watchdog !== void 0 ? { config: runsettings.watchdog } : {}, events: await memory.listwatchdogevents() } }), ...taskstate !== void 0 ? { taskstate } : {}, ...stitchprogress.size > 0 ? { stitchprogress: [...stitchprogress.values()] } : {}, mcp: await mcpstateof() };
     }
     case "capabilities":
       return refreshcapabilities();
@@ -17875,6 +18460,236 @@ async function handlerequest(message, sender) {
       const fires = await memory.listtriggerfires();
       return triggerlist({ rules: await memory.gettriggerules(), workflows: await memory.listworkflows(), queue: await memory.gettriggerqueue() });
     }
+    case "mcpstate": {
+      return mcpstateof();
+    }
+    case "mcpserverconfig": {
+      const inputconfig = message;
+      const current = await mcpconfigof();
+      const transports = Array.isArray(inputconfig.transports) && inputconfig.transports.length > 0 ? [...new Set(inputconfig.transports.filter((transport) => transport === "stdio" || transport === "http"))] : current.transports;
+      const config = {
+        ...inputconfig.bind !== void 0 ? { bind: inputconfig.bind } : current.bind !== void 0 ? { bind: current.bind } : {},
+        port: typeof inputconfig.port === "number" && Number.isFinite(inputconfig.port) && inputconfig.port > 0 && inputconfig.port <= 65535 ? Math.floor(inputconfig.port) : current.port,
+        transports,
+        ...inputconfig.framesize !== void 0 || current.framesize !== void 0 ? { framesize: typeof inputconfig.framesize === "number" ? inputconfig.framesize : current.framesize } : {},
+        ...inputconfig.queuedepth !== void 0 || current.queuedepth !== void 0 ? { queuedepth: typeof inputconfig.queuedepth === "number" ? inputconfig.queuedepth : current.queuedepth } : {},
+        ...inputconfig.callretention !== void 0 || current.callretention !== void 0 ? { callretention: typeof inputconfig.callretention === "number" ? inputconfig.callretention : current.callretention } : {},
+        enabled: inputconfig.enabled === true || inputconfig.enabled === void 0 && current.enabled === true,
+        ...inputconfig.remote === true || inputconfig.remote === void 0 && current.remote === true ? { remote: true } : {}
+      };
+      const bindcheck = serverbindgate(config);
+      if (!bindcheck.allowed) throw new Error(bindcheck.reason ?? "The server bind failed its gate.");
+      await memory.setmcpconfig(config);
+      const binding = bindlocalhost(config);
+      await audit("protocol", `Configured the mcp server for the ${binding.bind} bind on port ${binding.port} with the transports ${config.transports.join(" and ")}${config.framesize !== void 0 ? `, a frame size of ${config.framesize} characters` : " and no frame size cap"}${config.queuedepth !== void 0 ? `, a queue depth of ${config.queuedepth}` : " and an unbounded queue"}; every value stays the user choice and the server ${config.enabled ? "stays enabled" : "stays disabled"}.`, {});
+      return mcpstateof();
+    }
+    case "mcpserverstart": {
+      const config = { ...await mcpconfigof(), enabled: true };
+      const gate = serverenablementgate(config);
+      if (!gate.allowed) throw new Error(gate.reason ?? "The mcp server failed its enablement gate.");
+      await memory.setmcpconfig(config);
+      const binding = bindlocalhost(config);
+      const bridge = await trybridgelaunch(false);
+      await memory.setmcpstate({ state: "running", startedat: Date.now(), ...bridge !== void 0 ? { bridge } : {} });
+      await audit("protocol", `The user started the mcp server on ${binding.bind}:${binding.port} with the tool catalog of ${listtools(buildtoolcatalog()).tools.length} tools across the browser, workflow, memory and system namespaces; the localhost bind stays the default and every client waits for the pairing approval.`, {});
+      return mcpstateof();
+    }
+    case "mcpserverstop": {
+      const clients = await memory.getclients();
+      const now = Date.now();
+      for (const client of clients) {
+        const updated = disconnectclient(clients, client.id, now).find((entry) => entry.id === client.id);
+        if (updated) await memory.setclient(updated);
+      }
+      await memory.setmcpstate({ state: "stopped", stoppedat: now });
+      await audit("protocol", `The user stopped the mcp server; ${clients.length} connected client${clients.length === 1 ? "" : "s"} disconnected and no tool call passes the gates until the next start.`, {});
+      return mcpstateof();
+    }
+    case "mcpclientdecision": {
+      const inputdecision = message;
+      const clientid = inputdecision.clientid ?? "";
+      const clients = await memory.getclients();
+      const client = clients.find((entry) => entry.id === clientid);
+      if (!client || client.disconnectedat !== void 0) throw new Error(`No connected mcp client matches ${clientid}.`);
+      if (typeof inputdecision.approved !== "boolean") throw new Error("The client pairing decision needs the reviewed approved flag.");
+      const updated = inputdecision.approved ? { ...client, paired: true, pairedat: Date.now() } : { ...client, paired: false, disconnectedat: Date.now() };
+      await memory.setclient(updated);
+      await audit("protocol", `The user ${inputdecision.approved ? "approved the pairing of" : "refused and disconnected"} the mcp client ${clientid} on the ${client.transport} transport${inputdecision.approved ? "; its tool calls now pass the same consent gates as the panels" : "; its tool calls stay refused"}.`, {});
+      return mcpstateof();
+    }
+    case "mcpclientdisconnect": {
+      const inputdisconnect = message;
+      const clientid = inputdisconnect.clientid ?? "";
+      const clients = await memory.getclients();
+      const client = clients.find((entry) => entry.id === clientid);
+      if (!client || client.disconnectedat !== void 0) throw new Error(`No connected mcp client matches ${clientid}.`);
+      await memory.setclient({ ...client, disconnectedat: Date.now() });
+      await audit("protocol", `The user disconnected the mcp client ${clientid} on the ${client.transport} transport; its record stays for the audit trail.`, {});
+      return mcpstateof();
+    }
+    case "mcpbridge": {
+      const inputbridge = message;
+      const state = await memory.getmcpstate();
+      if (state?.state !== "running") throw new Error("The stdio bridge restart needs the running mcp server.");
+      const bridge = await trybridgelaunch(true);
+      await memory.setmcpstate({ ...state, ...bridge !== void 0 ? { bridge } : {} });
+      await audit("protocol", bridge !== void 0 ? `The stdio bridge restarted the local client process on demand; the bridge record counts the restart.` : `The stdio bridge restart found no native messaging host because the browser exposes no native messaging permission under the current permission set; the mcp frame grammar and the panel path stay fully available.`, {});
+      return mcpstateof();
+    }
+    case "mcpframe": {
+      const inputframe = message;
+      if (typeof inputframe.raw !== "string" || inputframe.raw.trim() === "") throw new Error("The mcp frame intake needs the raw wire frame.");
+      const transport = inputframe.transport === "http" ? "http" : "stdio";
+      return processmcpframe(inputframe.raw, inputframe.clientid ?? "", transport, inputframe.token, inputframe.fingerprint);
+    }
+    case "mcppairing": {
+      const inputpairing = message;
+      const scopes = (Array.isArray(inputpairing.scopes) ? inputpairing.scopes : []).filter((scope) => ["browser", "workflow", "memory", "system"].includes(scope));
+      const code = await issuepairingcodehandler(scopes);
+      return { code: code.code, scopes: code.scopes, issuedat: code.issuedat, expiresat: code.expiresat };
+    }
+    case "mcpchallenge": {
+      const state = await memory.getmcpstate();
+      if (state?.state !== "running") throw new Error("The auth challenge needs the running mcp server.");
+      const now = Date.now();
+      const challenge = issuechallenge({ method: "pairingcode", now });
+      await memory.setmcpstate({ ...state, challenge });
+      await memory.addauthhandshake({ id: randomid(), clientid: "new", method: "pairingcode", outcome: "issued", at: now });
+      await audit("protocol", "The server issued one auth challenge to a new remote client; the handshake verifies the single use nonce before any pairing exchange.", {});
+      return { nonce: challenge.nonce, method: challenge.method, expiresat: challenge.expiresat };
+    }
+    case "mcpexchange": {
+      const inputexchange = message;
+      const state = await memory.getmcpstate();
+      if (state?.state !== "running") throw new Error("The pairing exchange needs the running mcp server.");
+      const now = Date.now();
+      const challenge = state.challenge;
+      const fingerprint = typeof inputexchange.fingerprint === "string" && inputexchange.fingerprint.trim() !== "" ? inputexchange.fingerprint.trim() : "";
+      const refuseexchange = async () => {
+        await memory.addauthhandshake({ id: randomid(), clientid: "new", method: "pairingcode", outcome: "refused", at: now });
+        await audit("protocol", "The pairing exchange failed its auth handshake and was refused; the fixed refusal carries no pairing state.", {});
+        throw new Error("The remote frame failed its authentication handshake.");
+      };
+      if (fingerprint === "" || challenge === void 0 || inputexchange.nonce !== challenge.nonce || now >= challenge.expiresat) await refuseexchange();
+      const redeemed = redeempairingcode({ codes: await memory.getpairingcodes(), code: inputexchange.code ?? "", now });
+      if (redeemed.code === void 0) {
+        await memory.addauthhandshake({ id: randomid(), clientid: "new", method: "pairingcode", outcome: "refused", at: now });
+        await audit("protocol", "The pairing exchange presented a code that does not pair and was refused; a used or expired code never pairs a second client.", {});
+        throw new Error(redeemed.reason ?? "The remote frame failed its authentication handshake.");
+      }
+      await memory.usepairingcode(redeemed.code.code, now);
+      const identity = { fingerprint, displayname: typeof inputexchange.displayname === "string" && inputexchange.displayname.trim() !== "" ? inputexchange.displayname.trim() : `Client ${fingerprint.slice(0, 8)}` };
+      await memory.setclientidentity(identity);
+      await memory.setallowlistentry(grantallowlistentry({ entries: await memory.getallowlist(), identity, namespaces: redeemed.code.scopes, actor: "pairing", now })[0]);
+      const config = await mcpconfigof();
+      const clientid = `client-${now}`;
+      const issued = await issuetoken({ clientid, scopes: redeemed.code.scopes, now, ...config.remoteaccess?.tokenlifetimems !== void 0 ? { lifetime: config.remoteaccess.tokenlifetimems } : { lifetime: defaulttokenlifetimems } });
+      const client = { ...connectclient({ transport: "http", now, id: clientid }), fingerprint, paired: true, pairedat: now };
+      await memory.setclient(client);
+      await memory.setsessiontokens([...await memory.getsessiontokens(), issued.token]);
+      await memory.addauthhandshake({ id: randomid(), clientid, method: "pairingcode", outcome: "verified", at: now });
+      await audit("protocol", `The client ${identity.displayname} (${fingerprint}) exchanged its single use pairing code for a session token of the ${redeemed.code.scopes.join(", ") || "no"} namespace${redeemed.code.scopes.length === 1 ? "" : "s"}; the raw token leaves exactly once and only its digest persists.`, {});
+      return { clientid, token: issued.raw, scopes: issued.token.scopes, expiresat: issued.token.expiresat };
+    }
+    case "mcpremoteconfig": {
+      const inputremote = message;
+      const current = await mcpconfigof();
+      const endpoint = typeof inputremote.endpoint === "string" && inputremote.endpoint.trim() !== "" ? inputremote.endpoint.trim() : current.remoteaccess?.endpoint ?? "https://127.0.0.1:7436";
+      const tlsmode = inputremote.tlsmode === "off" || inputremote.tlsmode === "on" || inputremote.tlsmode === "required" ? inputremote.tlsmode : current.remoteaccess?.tls.mode ?? "off";
+      const certificatefingerprint = typeof inputremote.certificatefingerprint === "string" && inputremote.certificatefingerprint.trim() !== "" ? inputremote.certificatefingerprint.trim() : current.remoteaccess?.tls.certificatefingerprint;
+      const config = {
+        ...current,
+        ...inputremote.reviewed === true || current.remote === true ? { remote: true } : {},
+        httpstream: {
+          endpoint: current.httpstream?.endpoint ?? "/mcp",
+          streampath: typeof inputremote.streampath === "string" && inputremote.streampath.trim() !== "" ? inputremote.streampath.trim() : current.httpstream?.streampath ?? "/mcp/stream",
+          tls: { mode: tlsmode, ...certificatefingerprint !== void 0 ? { certificatefingerprint } : {}, ...current.httpstream?.tls.verifiedat !== void 0 ? { verifiedat: current.httpstream.tls.verifiedat } : {} },
+          ...inputremote.heartbeatms !== void 0 ? { heartbeatms: inputremote.heartbeatms } : current.httpstream?.heartbeatms !== void 0 ? { heartbeatms: current.httpstream.heartbeatms } : {},
+          ...inputremote.idlewindowms !== void 0 ? { idlewindowms: inputremote.idlewindowms } : current.httpstream?.idlewindowms !== void 0 ? { idlewindowms: current.httpstream.idlewindowms } : {}
+        },
+        remoteaccess: {
+          endpoint,
+          tls: { mode: tlsmode, ...certificatefingerprint !== void 0 ? { certificatefingerprint } : {} },
+          ...inputremote.maxclients !== void 0 ? { maxclients: inputremote.maxclients } : current.remoteaccess?.maxclients !== void 0 ? { maxclients: current.remoteaccess.maxclients } : {},
+          ...inputremote.tokenlifetime !== void 0 ? { tokenlifetimems: inputremote.tokenlifetime } : current.remoteaccess?.tokenlifetimems !== void 0 ? { tokenlifetimems: current.remoteaccess.tokenlifetimems } : {},
+          ...inputremote.approvaltimeoutms !== void 0 ? { approvaltimeout: { windowms: inputremote.approvaltimeoutms, ontimeout: "refuse" } } : current.remoteaccess?.approvaltimeout !== void 0 ? { approvaltimeout: current.remoteaccess.approvaltimeout } : {}
+        }
+      };
+      const gate = remoteenablementgate(config);
+      if (!gate.allowed) throw new Error(gate.reason ?? "The remote transport config failed its gate.");
+      const enablement = serverenablementgate(config);
+      if (!enablement.allowed) throw new Error(enablement.reason ?? "The remote transport config failed the enablement gate.");
+      await memory.setmcpconfig(config);
+      await audit("protocol", `The user configured the remote transport for the endpoint ${endpoint} with the ${tlsmode} tls mode${certificatefingerprint !== void 0 ? " and the reviewed certificate fingerprint" : ""}${config.remoteaccess?.maxclients !== void 0 ? `, a client ceiling of ${config.remoteaccess.maxclients}` : " and no client ceiling"}${config.remoteaccess?.tokenlifetimems !== void 0 ? `, a token lifetime of ${config.remoteaccess.tokenlifetimems} milliseconds` : ""}${config.remoteaccess?.approvaltimeout !== void 0 ? ` and an approval window of ${config.remoteaccess.approvaltimeout.windowms} milliseconds` : ""}; every value stays the user choice.`, {});
+      return mcpstateof();
+    }
+    case "mcpallowlist": {
+      const inputallow = message;
+      const fingerprint = typeof inputallow.fingerprint === "string" && inputallow.fingerprint.trim() !== "" ? inputallow.fingerprint.trim() : "";
+      if (fingerprint === "") throw new Error("The allowlist edit needs the client fingerprint.");
+      const now = Date.now();
+      if (inputallow.remove === true) {
+        const entries2 = await memory.getallowlist();
+        const removed = entries2.find((entry) => entry.fingerprint === fingerprint);
+        await memory.removeallowlistentry(fingerprint);
+        await audit("protocol", `The user refused the client ${removed?.displayname ?? fingerprint} its allowlist entry; its fingerprint stops passing the allowlist check.`, {});
+        return mcpstateof();
+      }
+      const namespaces = (Array.isArray(inputallow.namespaces) ? inputallow.namespaces : []).filter((scope) => ["browser", "workflow", "memory", "system"].includes(scope));
+      const identities = await memory.getclientidentities();
+      const known = identities.find((identity2) => identity2.fingerprint === fingerprint);
+      const identity = { fingerprint, displayname: typeof inputallow.displayname === "string" && inputallow.displayname.trim() !== "" ? inputallow.displayname.trim() : known?.displayname ?? `Client ${fingerprint.slice(0, 8)}` };
+      await memory.setclientidentity(identity);
+      const entries = grantallowlistentry({ entries: await memory.getallowlist(), identity, namespaces, actor: "user", now });
+      const granted = entries[0];
+      if (granted === void 0) throw new Error("The allowlist grant failed.");
+      const valid = allowlistentryvalid(granted, await memory.getclientidentities());
+      if (!valid.allowed) throw new Error(valid.reason ?? "The allowlist entry failed its validation.");
+      await memory.setallowlistentry(granted);
+      await audit("protocol", `The user allowed the client ${identity.displayname} (${fingerprint}) the ${namespaces.join(", ") || "no"} namespace${namespaces.length === 1 ? "" : "s"}; the grant history rides the record.`, {});
+      return mcpstateof();
+    }
+    case "mcprevokeclient": {
+      const inputrevoke = message;
+      const clientid = inputrevoke.clientid ?? "";
+      if (clientid === "") throw new Error("The revocation needs the client id.");
+      const gate = revocationgate();
+      if (!gate.allowed) throw new Error(gate.reason ?? "The revocation failed.");
+      const now = Date.now();
+      const tokens = revokeclient(await memory.getsessiontokens(), clientid, now);
+      await memory.setsessiontokens(tokens);
+      const client = (await memory.getclients()).find((entry) => entry.id === clientid);
+      if (client !== void 0 && client.disconnectedat === void 0) await memory.setclient(disconnectclient(await memory.getclients(), clientid, now).find((entry) => entry.id === clientid));
+      const revoked = tokens.filter((token) => token.clientid === clientid && token.revokedat === now).length;
+      await audit("protocol", `The user revoked the paired client ${clientid}; ${revoked} session token${revoked === 1 ? "" : "s"} stopped verifying and every further frame of the client refuses \u2014 the revocation stays available at any time.`, {});
+      return mcpstateof();
+    }
+    case "mcpapprovaldecision": {
+      const inputapproval = message;
+      const approvalid = inputapproval.approvalid ?? "";
+      if (approvalid === "" || typeof inputapproval.approved !== "boolean") throw new Error("The approval decision needs the gate id and the reviewed approved flag.");
+      const now = Date.now();
+      const stored = await memory.listapprovals();
+      const outcome = resolveapproval({ requests: stored, id: approvalid, decision: inputapproval.approved ? "approved" : "refused", actor: "user", now });
+      if (outcome.exec === void 0) throw new Error(`No pending approval gate matches ${approvalid}.`);
+      for (const request of outcome.requests) await memory.setapproval(request);
+      await memory.addapprovalexec(outcome.exec);
+      const gate = stored.find((request) => request.id === approvalid);
+      if (gate !== void 0 && inputapproval.approved) {
+        const tool = resolvetool(buildtoolcatalog(), gate.tool);
+        const stepid = typeof gate.params.stepid === "string" ? gate.params.stepid : void 0;
+        const plan = await memory.getplan();
+        const step = tool !== void 0 && tool.risk !== "read" && plan !== void 0 && stepid !== void 0 ? plan.steps.find((candidate) => candidate.id === stepid) : void 0;
+        if (step === void 0) throw new Error("The approved gate names no step the approved plan carries; the call refuses.");
+        const result = await executemcpstep(step);
+        await memory.addtoolcall(toolcallevent({ id: randomid(), clientid: gate.clientid, tool: gate.tool, origin: (await memory.getsession())?.origin ?? "", ok: !result.iserror, now }));
+        await audit("tool", `The approval gate ${approvalid} executed the ${gate.tool} call of the client ${gate.clientid} after the user approved it in ${outcome.exec.latencyms} milliseconds; no payload rides the record.`, {});
+      } else {
+        await audit("protocol", `The user refused the approval gate ${approvalid} for the ${gate?.tool ?? "tool"} call of the client ${gate?.clientid ?? "unknown"}; the pending call never executes.`, {});
+      }
+      return mcpstateof();
+    }
     case "runtobreakpoint": {
       const inputdebug = message;
       const session = await memory.getsession();
@@ -18238,6 +19053,213 @@ async function restorebackgroundruns() {
     await audit("workflow", `The worker wake restored the background run ${run.id} of the workflow ${record2.name} from its checkpoint at step cursor ${run.cursor}; the session, plan and origin gates re-passed.`, { sessionid: session.id, planid: plan.id });
   }
 }
+async function mcpconfigof() {
+  return await memory.getmcpconfig() ?? defaultmcpconfig();
+}
+async function mcpstateof() {
+  const config = await mcpconfigof();
+  const state = await memory.getmcpstate();
+  const binding = bindlocalhost(config);
+  const now = Date.now();
+  await mcpmaintenance(now);
+  const tokens = await memory.getsessiontokens();
+  const clients = await memory.listclients();
+  const channels = closeidlechannels({ channels: await memory.getstreamchannels(), now, ...config.httpstream?.idlewindowms !== void 0 ? { idlewindow: config.httpstream.idlewindowms } : {} });
+  await memory.setstreamchannels(channels);
+  const streamstatus = listremotestatus;
+  return { state: state?.state ?? "stopped", config, bind: binding.bind, port: binding.port, localhost: binding.localhost, clients, ...state?.bridge !== void 0 ? { bridge: state.bridge } : {}, calls: (await memory.listtoolcalls()).slice(0, 25), catalog: listtools(buildtoolcatalog()), launches: (await memory.listbridgelaunches()).slice(0, 10), remote: streamstatus({ config, channels, clients, tokens, now }), pairing: (await memory.getpairingcodes()).filter((code) => code.usedat === void 0 && now < code.expiresat), allowlist: await memory.getallowlist(), tokens, identities: await memory.getclientidentities(), handshakes: (await memory.listauthhandshakes()).slice(0, 10), channels, approvals: await memory.listapprovals() };
+}
+async function mcpmaintenance(now) {
+  const tokens = await memory.getsessiontokens();
+  const expired = tokens.filter((token) => token.revokedat === void 0 && now >= token.expiresat);
+  if (expired.length > 0) {
+    await memory.setsessiontokens(tokens.map((token) => expired.includes(token) ? { ...token, revokedat: now } : token));
+    await audit("protocol", `${expired.length} session token${expired.length === 1 ? "" : "s"} reached the user configured lifetime and the server refused ${expired.length === 1 ? "it" : "them"}; the records stay for the audit trail.`, {});
+  }
+  const stored = await memory.listapprovals();
+  const approvals = expireapprovals(stored, now);
+  for (let index = 0; index < approvals.length; index += 1) {
+    const request = approvals[index];
+    if (request !== void 0 && request.state === "expired" && stored[index]?.state === "pending") {
+      await memory.setapproval(request);
+      await audit("protocol", `The approval gate ${request.id} for the ${request.tool} call of the client ${request.clientid} expired unanswered and refused by default; the call never executes.`, {});
+    }
+  }
+}
+async function issuepairingcodehandler(scopes) {
+  const session = await memory.getsession();
+  const gate = pairingreadinessgate(session, Date.now());
+  if (!gate.allowed) throw new Error(gate.reason ?? "The pairing flow is refused.");
+  const code = issuepairingcode({ now: Date.now(), scopes });
+  await memory.addpairingcode(code);
+  await audit("protocol", `The user issued the pairing code for the ${code.scopes.join(", ") || "no"} namespace${code.scopes.length === 1 ? "" : "s"}; the code pairs one client once and expires in ${Math.round((code.expiresat - code.issuedat) / 1e3)} seconds.`, {});
+  return code;
+}
+async function raiseremoteapproval(clientid, toolname, params, step) {
+  const config = await mcpconfigof();
+  const tool = resolvetool(buildtoolcatalog(), toolname);
+  const request = requireapproval({ clientid, tool: toolname, reason: tool?.consentmeta?.review ?? `The ${toolname} tool has side effects and needs the approval gate.`, params: { ...params, stepid: step.id }, now: Date.now(), ...config.remoteaccess?.approvaltimeout !== void 0 ? { timeout: config.remoteaccess.approvaltimeout.windowms } : { timeout: defaultapprovalwindowms } });
+  await memory.setapproval(request);
+  await audit("protocol", `Raised the approval gate ${request.id} for the ${toolname} call of the remote client ${clientid}; the gate refuses by default after its window and no payload rides the audit.`, {});
+  return { content: `The approval gate ${request.id} holds the ${toolname} call; it executes once the user approves it in the panel.`, payload: { approvalid: request.id, state: "pending", ...request.timeoutat !== void 0 ? { timeoutat: request.timeoutat } : {} }, iserror: false };
+}
+async function executelistruns(step, session) {
+  const options = stepoptions2(step);
+  const statefilter = typeof options.state === "string" && options.state.trim() !== "" ? options.state : void 0;
+  const runs = await memory.listworkflowruns();
+  const selected = statefilter !== void 0 ? runs.filter((run) => run.state === statefilter) : runs;
+  await audit("workflow", `Listed ${selected.length} stored workflow run record${selected.length === 1 ? "" : "s"}${statefilter !== void 0 ? ` of the ${statefilter} state` : ""} from local memory as the read only listruns step; the listing carries no page data.`, { ...session ? { sessionid: session.id } : {}, stepid: step.id });
+  return { ok: true, summary: `Listed ${selected.length} stored workflow run${selected.length === 1 ? "" : "s"} from local memory.`, details: { runs: selected.map((run) => ({ id: run.id, workflowid: run.workflowid, state: run.state, cursor: run.cursor, startedat: run.startedat, ...run.dryrun === true ? { dryrun: true } : {} })) } };
+}
+async function executemcpstep(step) {
+  const session = await memory.getsession();
+  if (!session) throw new Error("No active browser session exists.");
+  const plan = await memory.getplan();
+  const output = await executeaction(step, session, plan, session.tabid, session.origin, await memory.getsettings(), void 0, "plan");
+  return { content: output.summary, ...output.details !== void 0 ? { payload: output.details } : {}, iserror: !output.ok };
+}
+async function trybridgelaunch(restart) {
+  const host = "com.wenathlan.devthink";
+  const runtime = chrome.runtime;
+  try {
+    const port = runtime.connectNative?.(host);
+    if (!port) throw new Error("The browser exposes no native messaging api under the current permission set.");
+    const previous = (await memory.getmcpstate())?.bridge;
+    const bridge = restart && previous !== void 0 ? restartbridgeof(previous) : launchbridge({ host, now: Date.now() });
+    port.onDisconnect.addListener(() => {
+      void (async () => {
+        const state = await memory.getmcpstate();
+        if (state?.bridge !== void 0) await memory.setmcpstate({ ...state, bridge: { ...state.bridge, connected: false } });
+      })().catch(() => {
+      });
+    });
+    port.onMessage.addListener((message) => {
+      if (typeof message !== "string") return;
+      void (async () => {
+        port.postMessage(serializeframe(await relaystdin(message)));
+      })().catch(() => {
+      });
+    });
+    return bridge;
+  } catch {
+    return void 0;
+  }
+}
+function restartbridgeof(bridge) {
+  return { ...bridge, connected: true, restarts: bridge.restarts + 1, startedat: Date.now() };
+}
+async function routemcpframe(client, frame, config, scopes) {
+  const session = await memory.getsession();
+  const plan = await memory.getplan();
+  const catalog = buildtoolcatalog();
+  const calledtool = frame.method === "tools/call" && typeof frame.params?.name === "string" ? resolvetool(catalog, frame.params.name.trim()) : void 0;
+  const gatedname = client.transport === "http" && calledtool !== void 0 && calledtool.risk !== "read" ? calledtool.name : void 0;
+  const callparams = frame.params ?? {};
+  const response = await handleframe({ frame, client, catalog, config, ...session !== void 0 ? { session } : {}, ...plan !== void 0 ? { plan } : {}, ...scopes !== void 0 ? { scopes } : {}, origin: session?.origin ?? "", tabid: session?.tabid ?? 0, now: Date.now(), execute: gatedname !== void 0 ? (step) => raiseremoteapproval(client.id, gatedname, callparams, step) : executemcpstep });
+  const now = Date.now();
+  if (frame.method === "initialize") {
+    const clientinfo = frame.params?.clientinfo && typeof frame.params.clientinfo === "object" && !Array.isArray(frame.params.clientinfo) ? frame.params.clientinfo : void 0;
+    const pid = typeof clientinfo?.pid === "number" && Number.isFinite(clientinfo.pid) ? clientinfo.pid : void 0;
+    if (pid !== void 0) {
+      const bridge = (await memory.getmcpstate())?.bridge;
+      await memory.addbridgelaunch({ id: randomid(), host: bridge?.host ?? "com.wenathlan.devthink", pid, restart: false, at: now });
+    }
+    await audit("protocol", `The mcp client ${client.id} completed the initialize handshake${pid !== void 0 ? ` and reported its process id ${pid} for the bridge launch record` : ""}; the server offered protocol version ${String(response.result?.protocolversion ?? "") || "its own"} and the client waits for the pairing approval.`, {});
+  }
+  if (frame.method === "tools/list") await audit("protocol", `The mcp client ${client.id} listed the tool catalog of ${listtools(catalog).tools.length} tools with their json schema inputs; the listing carries no page data.`, {});
+  if (frame.method === "negotiate") {
+    const agreed = response.error === void 0;
+    if (agreed && response.result !== void 0) {
+      await memory.setclientcapabilities(client.id, response.result);
+      const clientcaps = frame.params?.capabilities && typeof frame.params.capabilities === "object" && !Array.isArray(frame.params.capabilities) ? frame.params.capabilities : void 0;
+      const clientversion = typeof clientcaps?.toolversion === "number" && Number.isFinite(clientcaps.toolversion) ? clientcaps.toolversion : void 0;
+      const floor = negotiatetoolfloor(clientversion, catalog.version);
+      if ("floor" in floor) {
+        const stored = (await memory.getclients()).find((entry) => entry.id === client.id);
+        if (stored !== void 0) await memory.setclient({ ...stored, toolfloor: floor.floor });
+      }
+    }
+    await audit("protocol", `The mcp client ${client.id} ${agreed ? "negotiated its capability set with the server and the negotiated floor stays stored on its record" : `failed the capability negotiation: ${response.error?.message ?? "the sets did not agree"}`}.`, {});
+  }
+  if (frame.method === "tools/call") {
+    const name = typeof frame.params?.name === "string" ? frame.params.name : "";
+    const code = response.error?.code;
+    const ok = response.error === void 0 && response.result?.iserror !== true;
+    await memory.addtoolcall(toolcallevent({ id: randomid(), clientid: client.id, tool: name, origin: session?.origin ?? "", ok, now, ...code !== void 0 ? { code } : {} }));
+    if (plan !== void 0) {
+      const stepid = typeof frame.params?.stepid === "string" ? frame.params.stepid : "mcp";
+      await memory.setprogress(recordtoolcall(await memory.getprogress(), plan.id, stepid, { clientid: client.id, tool: name, ok, ...code !== void 0 ? { code } : {} }, now));
+    }
+    await audit("tool", `The mcp client ${client.id} called the ${name} tool on ${session?.origin ?? "no origin"} and ${ok ? gatedname !== void 0 ? "its approval gate waits for the user decision" : "it ran behind the consent gates" : `it was refused${code !== void 0 ? ` with the ${code} error` : ""}`}; no payload rides the record.`, {});
+  }
+  return response;
+}
+async function processmcpframe(raw, clientid, transport, rawtoken, fingerprint) {
+  const state = await memory.getmcpstate();
+  if (state?.state !== "running") return { jsonrpc: "2.0", id: null, error: rpcerrorof("consentrefused", "The mcp server is not running and no frame is routed.") };
+  const config = await mcpconfigof();
+  if (!config.transports.includes(transport)) return { jsonrpc: "2.0", id: null, error: rpcerrorof("consentrefused", `The ${transport} transport is not allowed by the server configuration.`) };
+  let frame;
+  try {
+    frame = parseframe(raw);
+  } catch {
+    await audit("protocol", "The mcp server refused a wire frame that does not parse as json; the parse error answered the client.", {});
+    return { jsonrpc: "2.0", id: null, error: rpcerrorof("parse", "The wire frame does not parse as json.") };
+  }
+  let scopes;
+  let routedclient = clientid;
+  if (transport === "http") {
+    const now = Date.now();
+    const ceiling = enforcemaxclients({ clients: await memory.getclients(), ...config.remoteaccess?.maxclients !== void 0 ? { maxclients: config.remoteaccess.maxclients } : {} });
+    if (!ceiling.allowed) {
+      await audit("protocol", `The remote connection of the client ${clientid || "unknown"} was refused because the user configured client ceiling is reached.`, {});
+      return { jsonrpc: "2.0", id: frame.id ?? null, error: rpcerrorof("consentrefused", ceiling.reason ?? "The remote connection was refused.") };
+    }
+    const toolname = frame.method === "tools/call" && typeof frame.params?.name === "string" ? frame.params.name : void 0;
+    const pipeline = await httpframepipeline({ config, ...fingerprint !== void 0 ? { presented: { fingerprint } } : {}, tokens: await memory.getsessiontokens(), ...rawtoken !== void 0 ? { rawtoken } : {}, allowlist: await memory.getallowlist(), fingerprint: fingerprint ?? "", ...toolname !== void 0 ? { toolname } : {}, now });
+    if (pipeline.error !== void 0) {
+      await memory.addauthhandshake({ id: randomid(), clientid: clientid || "unknown", method: "token", outcome: "refused", at: now });
+      await audit("protocol", `The remote frame of the client ${clientid || "unknown"} failed the ordered intake pipeline and was refused with the ${pipeline.error.code} error; no pairing state rides the record.`, {});
+      return { jsonrpc: "2.0", id: frame.id ?? null, error: pipeline.error };
+    }
+    scopes = pipeline.token?.scopes;
+    routedclient = pipeline.token?.clientid ?? clientid;
+    const channels = await memory.getstreamchannels();
+    const open = channels.filter((channel) => channel.clientid === routedclient && channel.closedat === void 0);
+    await memory.setstreamchannels(open.length > 0 ? heartbeat({ channels, clientid: routedclient, now }) : [...channels, openstreamchannel({ clientid: routedclient, now })]);
+  }
+  let client = (await memory.getclients()).find((entry) => entry.id === routedclient && entry.disconnectedat === void 0);
+  if (client === void 0) {
+    if (transport === "http") return { jsonrpc: "2.0", id: frame.id ?? null, error: rpcerrorof("consentrefused", "The remote frame names no paired client; pair the client through the pairing exchange first.") };
+    client = connectclient({ transport, now: Date.now(), ...clientid !== "" ? { id: clientid } : {} });
+    await memory.setclient(client);
+    await audit("protocol", `A new mcp client ${client.id} connected on the ${transport} transport and waits for the pairing approval; unpaired clients never dispatch tools.`, {});
+  }
+  const previous = mcpclientchains.get(client.id) ?? Promise.resolve();
+  const task = previous.catch(() => void 0).then(async () => await routemcpframe(client, frame, config, scopes));
+  mcpclientchains.set(client.id, task);
+  return task;
+}
+async function relaystdin(raw) {
+  const now = Date.now();
+  let state = await memory.getmcpstate();
+  if (state?.bridge !== void 0) {
+    let frame;
+    try {
+      frame = parseframe(raw);
+    } catch {
+      frame = void 0;
+    }
+    if (frame !== void 0) {
+      await memory.setmcpstate({ ...state, bridge: relayframe({ bridge: state.bridge, direction: "inbound", frame, now }) });
+      state = await memory.getmcpstate();
+    }
+  }
+  const response = await processmcpframe(raw, "", "stdio");
+  if (state?.bridge !== void 0) await memory.setmcpstate({ ...state, bridge: relayframe({ bridge: state.bridge, direction: "outbound", frame: response, now: Date.now() }) });
+  return response;
+}
+var mcpclientchains = /* @__PURE__ */ new Map();
 chrome.runtime.onMessage.addListener((message, sender, sendresponse) => {
   handlerequest(message, sender).then((value) => sendresponse({ ok: true, value })).catch((error) => sendresponse({ ok: false, error: error instanceof Error ? error.message : String(error) }));
   return true;